CVE-2026-59176 — Functype: RCE through MCP set_functype_version via unsanitized pnpm install and dynamic import

The set_functype_version MCP tool in functype-mcp-server accepts an unconstrained version string, inserts it directly into an npm package specifier, and runs pnpm install. After an attacker-controlled package is installed, it is dynamically imported, allowing arbitrary JavaScript to execute with the privileges of the MCP server process. The source rates the impact as High with CVSS 7.8.