What happened
CVE-2026-59176 (CVSS 7.8): functype-mcp-server prior to 1.4.4 accepts an unconstrained version string via only z.string() validation in packages/mcp-server/src/index.ts and interpolates it into a functype@<version> command, allowing an MCP client to inject shell commands that execute in the server's environment.
Why it matters
An MCP tool that builds a shell command from an unvalidated tool argument is a command-injection point for agents: an attacker who controls the tool input (or steers the agent via untrusted content) can run arbitrary commands with the MCP server's privileges.
Attack vector
Call the set_functype_version MCP tool with a crafted version string containing shell metacharacters; the interpolated functype@<version> command executes injected commands.
Affected systems
functype / functype-mcp-server before 1.4.4.
Mitigation
Upgrade functype-mcp-server to 1.4.4 or later (commit c0d58ad9c2a7d15c6117bd3adbbd75de37317dcf); constrain/validate the version input.