{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/functype-mcp-server-1.4.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["functype-mcp-server (1.4.3)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","mcp","nodejs"],"_cs_type":"advisory","_cs_vendors":["Jordan Burke"],"content_html":"\u003cp\u003eThe \u003ccode\u003efunctype-mcp-server\u003c/code\u003e tool \u003ccode\u003eset_functype_version\u003c/code\u003e (v1.4.3) is vulnerable to Remote Code Execution (RCE) because it fails to sanitize user input before passing it to the \u003ccode\u003epnpm add\u003c/code\u003e command. An attacker can supply a specially crafted version string, such as \u003ccode\u003efile:/path/to/malicious_package\u003c/code\u003e or other npm-supported alias syntaxes, to force the server to install an arbitrary local or remote package as the \u003ccode\u003efunctype\u003c/code\u003e dependency. Immediately following this installation, the server triggers \u003ccode\u003einitDocsData(true)\u003c/code\u003e, which dynamically imports the \u003ccode\u003efunctype/cli\u003c/code\u003e module from the newly created installation path. This process executes any module-level JavaScript contained within the attacker's package with the full privileges of the MCP server process. This vulnerability is particularly dangerous for AI coding agents that automatically invoke MCP tools based on prompts, as it allows for indirect prompt injection to achieve full system compromise.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker sends a \u003ccode\u003etools/call\u003c/code\u003e MCP request for \u003ccode\u003eset_functype_version\u003c/code\u003e to an exposed MCP server.\u003c/li\u003e\n\u003cli\u003eThe input \u003ccode\u003eversion\u003c/code\u003e argument, containing a malicious alias like \u003ccode\u003efile:/tmp/evil\u003c/code\u003e, is accepted by the server without validation (line 120, \u003ccode\u003eindex.ts\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server constructs a package specifier string \u003ccode\u003efunctype@file:/tmp/evil\u003c/code\u003e (line 123, \u003ccode\u003eindex.ts\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server executes \u003ccode\u003eexecFileSync(\u0026quot;pnpm\u0026quot;, [\u0026quot;add\u0026quot;, spec], ...)\u003c/code\u003e which installs the malicious directory as the \u003ccode\u003efunctype\u003c/code\u003e package (line 125, \u003ccode\u003eindex.ts\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe server process calls the \u003ccode\u003einitDocsData(true)\u003c/code\u003e function immediately after the installation finishes.\u003c/li\u003e\n\u003cli\u003eThe server invokes \u003ccode\u003erequire.resolve(\u0026quot;functype/cli\u0026quot;)\u003c/code\u003e, which resolves to the path of the newly installed attacker package.\u003c/li\u003e\n\u003cli\u003eThe server calls \u003ccode\u003eimport()\u003c/code\u003e on the resolved path, causing the Node.js runtime to execute the attacker's module code.\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled script performs malicious actions, such as reading environment variables or exfiltrating data, resulting in RCE.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full Remote Code Execution with the privileges of the MCP server process. This impacts confidentiality, integrity, and availability. Victims include developers using the server as an AI coding assistant and environments where AI agents connect to this MCP server, enabling potential exploitation via indirect prompt injection from malicious documentation or web content.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade \u003ccode\u003efunctype-mcp-server\u003c/code\u003e to a patched version that validates the \u003ccode\u003eversion\u003c/code\u003e argument against an allowlist (e.g., regex for semver or dist-tags) and rejects alias syntaxes like \u003ccode\u003efile:\u003c/code\u003e, \u003ccode\u003enpm:\u003c/code\u003e, or URL paths.\u003c/li\u003e\n\u003cli\u003eModify the \u003ccode\u003epnpm add\u003c/code\u003e execution logic to include the \u003ccode\u003e--ignore-scripts\u003c/code\u003e flag to mitigate potential execution of arbitrary pre/post-install scripts, though this does not fix the dynamic import sink.\u003c/li\u003e\n\u003cli\u003eRestrict access to the MCP server by implementing authentication or by running the server in an isolated, non-privileged container with minimal access to the host filesystem.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-10T00:51:11Z","date_published":"2026-09-10T00:51:11Z","id":"https://feed.craftedsignal.io/briefs/2026-09-functype-mcp-rce/","summary":"The set_functype_version MCP tool in functype-mcp-server allows unauthenticated attackers to execute arbitrary code by passing a malicious package alias to pnpm, which the server subsequently executes via dynamic import.","title":"Remote Code Execution in functype-mcp-server via Unsanitized MCP Tool Input","url":"https://feed.craftedsignal.io/briefs/2026-09-functype-mcp-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Functype-Mcp-Server (1.4.3)","version":"https://jsonfeed.org/version/1.1"}