Executive brief
The functype-mcp-server is an AI coding assistant integration that provides an MCP tool to update the functype package version. The `set_functype_version` tool accepts a version string without validation, interpolates it into an npm package specifier, and installs it via `pnpm add`. An attacker can supply a malicious version string (e.g., `file:/attacker/evil`) to install and execute arbitrary code on the server. This leads to full remote code execution with access to the server's process privileges, potentially exposing secrets, modifying files, or disrupting operations.
Technical details
The vulnerability is an arbitrary package installation and code execution flaw (CWE-829) in the `set_functype_version` MCP tool. The vulnerable code accepts a `version` parameter validated only with `z.string()`, with no semver or allowlist checks. This value is interpolated directly into a package specifier `functype@${args.version}` and passed to `pnpm add`. Because npm/pnpm support `file:`, `npm:`, URL, and path alias syntaxes, an attacker can supply a malicious specifier like `file:/tmp/evil` to cause pnpm to install an attacker-controlled directory. Immediately after installation, the server calls `initDocsData(true)`, which uses `require.resolve("functype/cli")` followed by dynamic `import()` to load the newly installed module. Any module-level code in the attacker's `cli.js` is executed at import time, granting full RCE with the server process privileges. No authentication is required in the default stdio MCP mode. Patch 1.4.4 is available.
Affected products
- Jordan Burke functype-mcp-server <= 1.4.3
Timeline
- 2026-06-20: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-09-09: advisory: GHSA-wcjj-9m6g-2fr2 updated
- 2026-09-09: patched: Patched in version 1.4.4