GHSA-wcjj-9m6g-2fr2: functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

Summary

The `set_functype_version` MCP tool in `functype-mcp-server` accepts an unvalidated `version` string and interpolates it into `functype@<version>`, which `pnpm add` installs without checks. Because package specifiers accept `file:` and `npm:` alias syntax, a client sending an MCP `tools/call` request can make the server install an arbitrary local or remote package as `functype`. The server then calls `initDocsData(true)`, which dynamically imports `functype/cli` from that package, executing attacker-controlled JavaScript in the MCP server process as remote code execution with the server's privileges (CVSS 7.8 High).

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Topics

• Model Context Protocol

Related items

• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• HighCVE-2026-118627: MLflow SHAP load_explainer untrusted deserialization enables code executionSimilar attack · NVD/CVE Database
• HighCVE-2026-118623: MLflow PickleEvaluationArtifact remote code execution via untrusted pickleSimilar attack · NVD/CVE Database
• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSimilar attack · NVD/CVE Database