THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-wcjj-9m6g-2fr2 (high) — functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

[GHSA] GHSA-wcjj-9m6g-2fr2 (high) — functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

medgithub_advisoriesPublished 2026-09-09

GHSA-wcjj-9m6g-2fr2 Severity: high CVE: CVE-2026-59176

functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

## MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

### Summary

The `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string, interpolates it dir

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-59176cve

Original source: https://github.com/advisories/GHSA-wcjj-9m6g-2fr2