Read the docs

Framelink

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Framelink records in CISA KEV

No Framelink vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2025-13741 CVE-2025-15061 · GHSA-8675-cg27-5c39

OS command injection in Framelink Figma MCP Server

Priority HIGH 82

Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02178 Published 2026-01-23 No fix listed CWE-78
TI-2025-33823 CVE-2025-53967 · GHSA-gxw4-4fc5-9gr5

Command injection in Framelink Figma MCP Server

Priority HIGH 68

Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchW…

CVSS 3.1HIGH 8.0 Adjacent network No auth No interaction EPSS 0.06118 Published 2025-10-08 Fixed in 0.6.3 CWE-420
Open these records in search →