The "set_functype_version" MCP tool in "functype-mcp-server" accepts an unconstrained "version" string, interpolates it directly into an npm package specifier ("functype@<version>"), and installs it via "pnpm add" without any validation. Because npm/pnpm package specifiers support "file:", "npm:", and other alias syntaxes, an attacker who can send an MCP "tools/call" request to this tool can cause the server to install an arbitrary local or remote package as "functype". Immediately after installation, the server calls "initDocsData(true)", which dynamically imports "functype/cli" from the newly installed location, executing attacker-controlled JavaScript in the MCP server process. This results in full Remote Code Execution (RCE) with the privileges of the server process — full confidentiality, integrity, and availability impact (CVSS 7.8 High).