CVE-2026-59176: functype-mcp-server package alias remote code execution (<= 1.4.3)
- Product
- functype-mcp-server (npm)
- CVE
- CVE-2026-59176
- Affected
- <= 1.4.3
- Fixed in
- 1.4.4
Last verified against sources: October 16, 2026
Am I affected?
functype-mcp-server (npm): affected <= 1.4.3. Fixed in 1.4.4.
What to do now
- Upgrade functype-mcp-server to 1.4.4 or later. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- According to GitHub Advisory Database's advisory (Sept 9, 2026), the set_functype_version MCP tool accepted an unconstrained version string, interpolated it into functype@<version>, and installed it via pnpm add before dynamically importing functype/cli. [1]
Impact
- Because package specifiers support file: and npm: aliases, an attacker able to call the tool could install an arbitrary package and execute JavaScript in the MCP server process (CVSS 7.8). [1]
What was done
- Patched in functype-mcp-server 1.4.4. [1]
Sources
- GHSA-wcjj-9m6g-2fr2 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-59176] CVE-2026-59176: functype-mcp-server package alias remote code execution (<= 1.4.3)
Product: functype-mcp-server (npm) | Affected: <= 1.4.3 | Fixed in: 1.4.4
Summary: According to GitHub Advisory Database's advisory (Sept 9, 2026), the set_functype_version MCP tool accepted an unconstrained version string, interpolated it into functype@<version>, and installed it via pnpm add before dynamically importing functype/cli.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/09/cve-2026-59176-functype-mcp-server-rceCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-59176
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.