CVE-2026-59176: 
JavaScript Análise e mitigação de vulnerabilidades

CVE-2026-59176 is a Remote Code Execution (RCE) vulnerability in the functype-mcp-server npm package, specifically in the set_functype_version MCP tool. The tool accepts an unconstrained version string, interpolates it directly into a pnpm package specifier (functype@<version>), and installs it without any validation — allowing attackers to supply file:, npm:, git+, or URL alias syntaxes to install arbitrary packages. Affected versions are functype-mcp-server <= 1.4.3; version 1.4.4 contains the fix. The vulnerability was originally published on June 20, 2026, and added to the GitHub Advisory Database on September 9, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Repo Advisory).

The root cause is CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). In packages/mcp-server/src/index.ts, the set_functype_version tool (registered at line 115, enabled by default with no authentication in stdio mode) accepts args.version validated only as z.string() — no semver format check, no allowlist, and no rejection of alias syntaxes. The unsanitized value is interpolated into the specifier functype@${args.version} and passed to execFileSync("pnpm", ["add", spec], ...). Because pnpm honors file:, npm:, git+, and URL alias syntaxes, an attacker can install an arbitrary local or remote package as the functype alias. Immediately after installation, initDocsData(true) is called, which resolves functype/cli via require.resolve and dynamically imports it — executing any module-level JavaScript in the attacker-controlled package at import time. In non-default TRANSPORT_TYPE=httpStream deployments, the tool was also exposed to unauthenticated network callers (GitHub Advisory, Patch Commit).

Successful exploitation results in full Remote Code Execution with the privileges of the MCP server process, yielding high confidentiality, integrity, and availability impact. An attacker can read secrets and environment variables from the process, modify or delete files on the host, crash the server, or use the compromised process as a pivot point for further lateral movement within the developer's local environment or CI/CD pipeline. The attack surface is particularly concerning in AI agent contexts: an LLM agent connected to this MCP server and susceptible to indirect prompt injection (e.g., via a malicious document or web page) could be manipulated into triggering the set_functype_version call with a malicious payload without any direct attacker interaction with the server (GitHub Advisory).

A working, detailed Proof-of-Concept (PoC) is publicly available in the GitHub Security Advisory, including a Dockerfile for fully automated end-to-end reproduction that was confirmed to succeed (creating /pwned.txt with attacker-controlled content). The vulnerability requires no privileges and no authentication in the default stdio transport mode; user interaction is required only in the sense that the MCP server must be running and a client must connect. No in-the-wild exploitation or threat actor attribution has been reported as of the advisory date. The CVE status is listed as Reserved, and no EPSS score or CISA KEV catalog entry is currently available (GitHub Advisory, Repo Advisory).

1. Prepare attacker-controlled evil package: Create a local directory (e.g., /tmp/evil) with a package.json exporting a ./cli entry point and a cli.js file containing arbitrary JavaScript (e.g., writing a file, spawning a shell, or exfiltrating environment variables) that executes at module import time.

2. Identify a target: Locate a developer or CI environment running functype-mcp-server <= 1.4.3 in stdio mode (default). In an AI agent scenario, craft a malicious document or web page that, when read by the LLM agent connected to the MCP server, triggers a set_functype_version tool call.

3. Send the malicious MCP tools/call request: Using an MCP client (e.g., @modelcontextprotocol/sdk), connect to the running MCP server and call the set_functype_version tool with version: "file:/tmp/evil" (or npm:evil-package@1.0.0 for a remote payload).

4. Trigger arbitrary package installation: The server constructs the specifier functype@file:/tmp/evil and executes pnpm add functype@file:/tmp/evil, installing the attacker's directory as the functype package alias in the server's node_modules.

5. Achieve RCE via dynamic import: The server immediately calls initDocsData(true), which resolves functype/cli (now pointing to the attacker's cli.js) and dynamically imports it. All module-level code in cli.js executes in the MCP server process with its full privileges.

6. Verify execution: Confirm arbitrary code execution (e.g., check for the created /pwned.txt file or observe outbound network connections from the server process) (GitHub Advisory, Repo Advisory).

• Process: Unexpected pnpm child process spawned by the MCP server Node.js process with arguments containing add functype@file:, add functype@npm:, add functype@git+, or other alias syntaxes; unusual child processes (e.g., sh, bash, curl, wget) spawned by the MCP server process after a set_functype_version call.
• File System: New or modified files in the MCP server's node_modules/functype directory pointing to an unexpected local path or containing unfamiliar code; unexpected files written to the filesystem (e.g., /pwned.txt or similar artifacts); new cron jobs or startup scripts created by the server process account.
• Logs: MCP server logs showing a tools/call request for set_functype_version with a version argument containing :, /, \, @, or URL-like strings (e.g., file:, npm:, git+, https://); pnpm add invocations logged with non-semver package specifiers.
• Network: Outbound connections from the MCP server process to unexpected external hosts (indicative of remote package fetch or reverse shell) following a set_functype_version invocation; DNS lookups for attacker-controlled domains from the server host (GitHub Advisory).

Upgrade functype-mcp-server to version 1.4.4 or later, which includes the following fixes: (1) input validation via a strict regex that accepts only semver strings (with optional ~/^/v prefix and prerelease/build metadata) and known dist-tags (latest, next, beta, alpha, canary, rc), rejecting any string containing :, /, \, @, or whitespace; (2) --ignore-scripts flag added to the pnpm add invocation as defense-in-depth; (3) set_functype_version is now only registered when TRANSPORT_TYPE=stdio (not exposed over HTTP); and (4) the HTTP listener now defaults to HOST=127.0.0.1 instead of 0.0.0.0. If immediate upgrade is not possible, avoid running the MCP server with TRANSPORT_TYPE=httpStream and restrict access to the stdio transport to trusted local processes only (Patch Commit, GitHub Advisory).

The vulnerability was discovered and reported by @EQSTLab, credited in both the GitHub Security Advisory and the patch commit. The maintainer (jordanburke) published the advisory and patch promptly. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory, Patch Commit).