CVE-2025-53967 - CVE House
Back to Database
Status published High CVE-2025-53967

Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote...

Vulnerability Description

Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize user-supplied input, enabling the attacker to inject malicious commands that are executed with the privileges of the MCP process. Exploitation requires network access to the MCP interface.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53967

Credits & Attribution

No credits recorded in the NVD database.

References

More from Framelink

View All →
CVE-2025-15061
Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability
Critical 9.8

Affected Vendor

Affected Software

Figma MCP Server
Vulnerable Versions:
0

Timeline

Official Publish: October 8th, 2025
Last Modified: October 8th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weaknesses (CWE)

CWE-420

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.