CVE-2025-53967

Published Oct 8, 2025

Last updated 2 days ago

Framelink Figma MCP

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-53967 is a command injection vulnerability found in the figma-developer-mcp Model Context Protocol (MCP) server. The vulnerability stems from the unsanitized use of user input when the server constructs and executes shell commands. An attacker could exploit this by sending arbitrary system commands. The vulnerability exists in the `get_figma_data` tool. Specifically, the `fetchWithRetry` function uses the standard fetch API and, if that fails, falls back to executing a curl command via `child_process.exec`. Because the curl command is constructed by directly interpolating URL and header values into a shell command string, a malicious actor could craft a specially designed URL or header value that injects arbitrary shell commands. This can lead to remote code execution (RCE) on the host machine. The vulnerability has been addressed in version 0.6.3 of figma-developer-mcp.

Description: Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize user-supplied input, enabling the attacker to inject malicious commands that are executed with the privileges of the MCP process. Exploitation requires network access to the MCP interface.
Source: cve@mitre.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8
Impact score: 5.8
Exploitability score: 1.6
Vector string: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-420

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

References