HIGH
jordanburke
CVE published 2026-09-09
CVE-2026-59176
The `set_functype_version` MCP tool in `functype-mcp-server` is vulnerable to Remote Code Execution (RCE) due to unsanitized package alias input. An attacker can cause the server to install an arbitrary package, leading to full confidentiality, integrity, and availability impact. This vulnerability exists because the tool accepts an unconstrained `version` string, interpolates it directly into an npm pack [truncated]