Skip to content
OpenAdvisories

Package · npm

functype-mcp-server

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High 7.8
    CVE-2026-59176

    Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import

    Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string using only `z.string()` validation in `packages/mcp-server/src/index.ts…

    jordanburke functype functype-mcp-server npm