---
id: "CVE-2026-59176"
kind: "vulnerability"
aliases: ["CVE-2026-59176"]
title: "Functype MCP server: version argument lets a tool call run attacker JavaScript"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "claude-code", "functype", "mcp", "self-hosted", "typescript"]
not_affected_if: ["functype-mcp-server-not-installed", "version-1.4.4-or-later"]
published_at: "2026-10-28T14:17:04+00:00"
first_seen_at: "2026-10-28T14:33:23+00:00"
updated_at: "2026-10-28T14:34:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59176", "first_seen_at": "2026-10-28T14:33:23+00:00"}]
---

# Functype MCP server: version argument lets a tool call run attacker JavaScript

The functype MCP server's set_functype_version tool passes an unvalidated version string to pnpm add, so package aliases such as file:, npm: or URLs install an attacker-chosen package. The server then imports that package, so an attacker runs JavaScript with the server's privileges and can read secrets, modify files or stop the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `pnpm list functype` or inspect the functype-mcp-server package version in the project to see if it is below `1.4.4`
- Check whether the MCP server runs with `TRANSPORT_TYPE=httpStream`, which exposes it to the network

## Fix

- Upgrade functype-mcp-server to `1.4.4` or later
- Until upgraded, disable the set_functype_version tool or stop the MCP server from accepting tools/call requests from untrusted clients

## Timeline

- 2026-10-28T14:33:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59176

## From the sources

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string using only `z.string()` validation in `packages/mcp-server/src/index.ts` and interpolates it into `functype@<version>` for `pnpm add`. Package-alias syntaxes such as `file:`, `npm:`, URLs, or paths can cause an arbitrary local or remote package to be installed as functype. Immediately afterward, `initDocsData(true)` in `packages/mcp-server/src/lib/docs/data.ts` resolves `functype/cli` and dynamically imports the newly installed module, executing attacker-controlled JavaScript with the MCP server process's privileges. Any MCP client able to send a `tools/call` request invoking the tool can exploit the flaw; the tool is enabled by default without authentication in `stdio` mode. A connected AI assistant susceptible to indirect prompt injection can also be induced to invoke it from a malicious document or web page. In non-default `TRANSPORT_TYPE=httpStream` deployments, a network-accessible attacker does not require local access. Successful execution can read process secrets, modify files, or terminate the server. This issue is fixed in `version` 1.4.4.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_