CVE-2026-59176

Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string using only z.string validation in packages/mcp-server/src/index.ts and interpolates it into functype@ for pnpm add...