Command injection in Framelink Figma MCP Server
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize user-supplied input, enabling the attacker to inject malicious commands that are executed with the privileges of the MCP process. Exploitation requires network access to the MCP interface.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Framelink | Figma MCP Server | before 0.6.3 | 0.6.3 | Patch available | CNA |
| — | figma-developer-mcp (npm) | before 0.6.3 | 0.6.3 | Patch available | GHSA-gxw4-4fc5-9gr5 |
- Figma MCP Server VendorFramelink Affected before 0.6.3 Fixed in 0.6.3 Patch available CNA
- figma-developer-mcp (npm) Vendor— Affected before 0.6.3 Fixed in 0.6.3 Patch available GHSA-gxw4-4fc5-9gr5
Remediation
- Fix · CNA Figma MCP Server (Framelink) Fixed in 0.6.3
- Fix · GHSA-gxw4-4fc5-9gr5 figma-developer-mcp (npm) Fixed in 0.6.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53967
- 2026-10-03 Alias added: GHSA-gxw4-4fc5-9gr5
References
Other 6
- https://github.com/GLips/Figma-Context-MCP/blob/96b3852669c5eed65e4a6e20406c25504d9196f2/src/utils/fetch-with-retry.ts#L34
- https://www.imperva.com/blog/another-critical-rce-discovered-in-a-popular-mcp-server/
- https://github.com/GLips/Figma-Context-MCP/releases/tag/v0.6.3
- https://github.com/GLips/Figma-Context-MCP/security/advisories/GHSA-gxw4-4fc5-9gr5
- https://github.com/GLips/Figma-Context-MCP/commit/7f4b5859454b0567c2121ff22c69a0344680b124
- https://github.com/GLips/Figma-Context-MCP
More Framelink vulnerabilities
- TI-2025-13741 OS command injection in Framelink Figma MCP Server CVSS 3.0CRITICAL 9.8
Sources
- CVE-2025-53967 · CVE Program
- CVE-2025-53967 · NVD
- FIRST EPSS
- GHSA-gxw4-4fc5-9gr5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences