CVE-2026-59176

Functype MCP version switching can install and execute arbitrary packages

jordanburke · functype-mcp-server

First documented disclosure · Review checkpoint

Summary

A version argument can select an attacker-controlled package that the MCP server immediately imports.

Severity and exploitation evidence

High · 7.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources establish a vulnerability or controlled demonstration, not malicious exploitation against a victim. Exact-ID lookup found no entry in CISA KEV catalog 2026.10.27; absence does not prove no exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Unconstrained package specifiers reach pnpm installation; subsequent dynamic import executes the newly installed module.

Conditions required

An MCP client invokes set_functype_version; default stdio is local, while non-default httpStream exposure can permit network access. An agent may be steered by untrusted content.

Potential impact

JavaScript execution with the MCP server’s access to secrets and files.

Affected versions and configurations

functype-mcp-server / Functype before 1.4.4.

Fix and mitigation status

1.4.4.

Practical next steps

Upgrade, disable unneeded package-management tools and restrict allowed version syntax and package sources.

Operating lesson

Version-selection tools must not silently confer arbitrary package-install authority.

Evidence and limits

The maintainer advisory was public June 20; CVE publication October 28. An isolated reproduction created a marker file. The CNA 7.8 CVSS 3.1 local/user-interaction vector describes the default integration; network mode has different reachability.

Sources