CVE-2026-59176: 
JavaScript vulnerability analysis and mitigation

CVE-2026-59176 is a Remote Code Execution (RCE) vulnerability in the functype-mcp-server npm package, specifically in the set_functype_version MCP tool. The tool accepts an unconstrained version string, interpolates it directly into a pnpm package specifier (functype@<version>), and installs it without any validation — allowing attackers to supply file:, npm:, git+, or URL alias syntaxes to install arbitrary packages. All versions of functype-mcp-server up to and including 1.4.3 are affected; version 1.4.4 contains the fix. The vulnerability was originally published on June 20, 2026, and added to the GitHub Advisory Database on September 9, 2026, with a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, functype Advisory).

The root cause is CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): the set_functype_version tool in packages/mcp-server/src/index.ts applies only a z.string() schema validation to the version parameter — no semver format check, no allowlist for dist-tags, and no rejection of file:, npm:, URL, or path alias syntaxes. The attacker-controlled string is interpolated into the specifier functype@${args.version} and passed directly to execFileSync("pnpm", ["add", spec], ...). Because pnpm honors file: and other alias syntaxes, this installs an arbitrary local or remote package as the functype alias in node_modules. Immediately after installation, initDocsData(true) is called, which resolves functype/cli via require.resolve and dynamically imports it — executing any module-level JavaScript in the attacker's package within the MCP server process. The tool is registered by default with no authentication required in stdio mode, and a fully functional PoC (including a Docker-based reproduction) is publicly available in the advisory (GitHub Advisory, functype Advisory).

Successful exploitation grants the attacker full RCE with the privileges of the MCP server process, resulting in high confidentiality, integrity, and availability impact. An attacker can read secrets and environment variables from the process, modify or delete files accessible to the server, install persistent backdoors, or crash the server entirely. In AI agent deployments where an LLM is connected to this MCP server, indirect prompt injection via a malicious document or web page could trigger the exploit without any direct attacker interaction with the server. In non-default TRANSPORT_TYPE=httpStream deployments (previously binding to 0.0.0.0), network-accessible attackers could exploit this without local access (GitHub Advisory, functype Advisory).

A complete, working proof-of-concept is publicly available in the GitHub advisory, including a Dockerfile for automated end-to-end reproduction that was confirmed to create /pwned.txt with the expected payload string. The exploit requires no privileges and no authentication (in the default stdio transport mode), though it does require user interaction in the sense that a client must invoke the MCP tool. No in-the-wild exploitation has been reported, no threat actor attribution is available, and the CVE is not listed in the CISA KEV catalog. EPSS score data is not yet available for this CVE (GitHub Advisory, functype Advisory).

1. Prepare attacker-controlled package: Create a malicious npm package directory (e.g., /tmp/evil/) with a package.json exporting a ./cli entry point and a cli.js file containing arbitrary JavaScript to execute at import time (e.g., writing a file, spawning a shell, or exfiltrating environment variables).

mkdir -p /tmp/evil
cat > /tmp/evil/package.json <<'EOF'
{"name":"evil-functype","version":"1.0.0","type":"module","exports":{"./cli":"./cli.js"}}
EOF
cat > /tmp/evil/cli.js <<'EOF'
import { writeFileSync } from "node:fs";
writeFileSync("/pwned.txt", "RCE via set_functype_version\n");
EOF

2. Identify target: Locate a system running functype-mcp-server <= 1.4.3 in stdio mode (default) as part of an AI coding assistant or CI environment. In httpStream mode (pre-patch), the server may be network-accessible on port 3000 bound to 0.0.0.0.

3. Set up MCP client: Install the @modelcontextprotocol/sdk and create an exploit script (exploit.mjs) that connects to the victim MCP server via stdio transport.

4. Send malicious tools/call request: Invoke the set_functype_version tool with version: "file:/tmp/evil" as the argument. The server constructs the specifier functype@file:/tmp/evil and executes pnpm add functype@file:/tmp/evil, installing the attacker's package into node_modules as the functype alias.

5. Trigger dynamic import: The server automatically calls initDocsData(true), which resolves functype/cli from the newly installed attacker package and dynamically imports it — executing the module-level code in cli.js within the MCP server process.

6. Achieve RCE: The attacker's JavaScript runs with the full privileges of the MCP server process, enabling file system access, environment variable exfiltration, reverse shell establishment, or any other arbitrary action (GitHub Advisory, functype Advisory).

• Process: Unexpected pnpm add subprocess spawned by the MCP server Node.js process with a file:, npm:, git+, or URL-based package specifier as an argument.
• File System: New or modified files in the node_modules/functype/ directory of the MCP server installation that do not match the expected published package contents; unexpected files written to arbitrary paths (e.g., /pwned.txt or similar artifacts from attacker payloads); new scripts or binaries created by the server process.
• Logs: MCP server logs showing a tools/call request for set_functype_version with a version argument containing file:, npm:, git+, http://, https://, ../, or other non-semver syntax; pnpm add invocations logged with alias-style package specifiers.
• Network: Outbound connections from the MCP server process to unexpected external hosts (e.g., attacker-controlled npm registries or git repositories) following a set_functype_version tool call; in httpStream mode, inbound HTTP requests to port 3000 with MCP tools/call payloads targeting set_functype_version.
• Environment: Unexpected environment variable access or exfiltration patterns in process monitoring; new cron jobs, scheduled tasks, or persistence mechanisms created under the server process's user account (GitHub Advisory).

Upgrade functype-mcp-server to version 1.4.4 or later, which includes three security fixes: (1) strict regex validation of the version parameter rejecting any string containing :, /, \, @, or whitespace — blocking all file:, npm:, git+, and URL alias syntaxes; (2) --ignore-scripts flag added to the pnpm add invocation as defense in depth; and (3) the set_functype_version tool is now only registered when TRANSPORT_TYPE=stdio, preventing exposure over HTTP transport. Additionally, the HTTP listener default was changed from 0.0.0.0 to 127.0.0.1. If immediate upgrade is not possible, disable httpStream transport and ensure the MCP server is not accessible to untrusted callers or LLM agents that process untrusted content (GitHub Advisory, Patch Commit).

The vulnerability was discovered and reported by @EQSTLab, credited in both the GitHub advisory and the patch commit. The maintainer (jordanburke) published the advisory and patch promptly. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GitHub Advisory, Patch Commit).