The set_functype_version tool in Functype’s MCP server accepts any input string as a version and uses it to run `pnpm add functype@<version>`. Because the validation is only a generic string check, package‑alias syntax such as file:, npm:, URLs, or local paths can be used to cause the server to install an arbitrary package. Immediately afterward the tool imports the newly installed package and executes its JavaScript in the context of the MCP server, giving the attacker the same privileges as the process. An attacker can therefore read secrets, modify files, or terminate the server. The flaw is a classic Remote Code Execution vulnerability because the attacker supplies arbitrary code that runs with server privileges.

Functype library, specifically the functype‑mcp‑server component from JordanBurke, is affected in all versions released prior to 1.4.4. The 1.4.4 release contains a fix that removes the unsanitized version handling logic.

The vulnerability scores a high CVSS of 7.8. EPSS information is not available and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending a tools/call request to the MCP server; the set_functype_version tool is enabled by default without authentication when the server runs in stdio mode, so any connected client can trigger it. In deployments that use the httpStream transport, a network‑accessible attacker can also invoke the tool. Given the high severity score and the readily exploitable nature of the vulnerability, the risk to affected systems is considered high.