Threats tagged 'ghsa-wcjj-9m6g-2fr2'

The functype-mcp-server contains a high-severity remote code execution vulnerability (CVE-2026-59176) in its set_functype_version tool. This tool accepts an unsanitized version string that is directly interpolated into an npm package specifier and installed via pnpm without validation. An attacker can exploit this by supplying a malicious package alias, causing the server to install and dynamically import attacker-controlled code, resulting in full RCE with server process privileges. The vulnerability affects versions prior to 1.4.4 and is patched in version 1.4.4.