Attack Chain

1. An attacker sends a tools/call MCP request for set_functype_version to an exposed MCP server.
2. The input version argument, containing a malicious alias like file:/tmp/evil, is accepted by the server without validation (line 120, index.ts).
3. The server constructs a package specifier string functype@file:/tmp/evil (line 123, index.ts).
4. The server executes execFileSync("pnpm", ["add", spec], ...) which installs the malicious directory as the functype package (line 125, index.ts).
5. The server process calls the initDocsData(true) function immediately after the installation finishes.
6. The server invokes require.resolve("functype/cli"), which resolves to the path of the newly installed attacker package.
7. The server calls import() on the resolved path, causing the Node.js runtime to execute the attacker's module code.
8. The attacker-controlled script performs malicious actions, such as reading environment variables or exfiltrating data, resulting in RCE.

Impact

Successful exploitation results in full Remote Code Execution with the privileges of the MCP server process. This impacts confidentiality, integrity, and availability. Victims include developers using the server as an AI coding assistant and environments where AI agents connect to this MCP server, enabling potential exploitation via indirect prompt injection from malicious documentation or web content.

Recommendation

1. Upgrade functype-mcp-server to a patched version that validates the version argument against an allowlist (e.g., regex for semver or dist-tags) and rejects alias syntaxes like file:, npm:, or URL paths.
2. Modify the pnpm add execution logic to include the --ignore-scripts flag to mitigate potential execution of arbitrary pre/post-install scripts, though this does not fix the dynamic import sink.
3. Restrict access to the MCP server by implementing authentication or by running the server in an isolated, non-privileged container with minimal access to the host filesystem.