CVE-2026-59176 jordanburke CVE debrief

Who should care

Defenders responsible for `functype-mcp-server` deployments should assess exposure and prioritize remediation due to the high severity of this RCE vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, defenders should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and implement compensating controls for

Why it matters

CVE-2026-59176 is a high-severity RCE vulnerability in `functype-mcp-server` that allows attackers to execute arbitrary code with server privileges. Defenders should prioritize remediation and verify exposure.

• Full confidentiality impact due to potential data exposure
• Full integrity impact due to potential code modification
• Full availability impact due to potential service disruption
• Verification priority for inventory checks and compensating controls

Technical summary

The `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string, interpolates it directly into an npm package specifier, and installs it via `pnpm add` without validation. This allows an attacker to install an arbitrary local or remote package as `functype`, leading to RCE with the privileges of the server process. The vulnerability exists in the `packages/mcp-server/src/index.ts` file, specifically in the `set_functype_version` tool, which is registered at line 115 and is enabled by default with no authentication required in stdio mode. The dynamic import of `functype/cli` from the newly installed location allows for the execution of attacker-controlled JavaScript

Defensive priority

High

Recommended defensive actions

• Verify and upgrade `functype-mcp-server` to version 1.4.4 or later
• Restrict access to the `set_functype_version` MCP tool
• Implement input validation for package aliases
• Monitor for suspicious package installations and dynamic imports
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability exists in the `packages/mcp-server/src/index.ts` file, specifically in the `set_functype_version` tool. The tool is registered at line 115 and is enabled by default with no authentication required in stdio mode.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.