CyberSecBulletin

Framelink vulnerabilities

We track 2 vulnerabilities in Framelink products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on January 23, 2026.

2vulnerabilities
1critical
1high
0exploited
8.9average CVSS score

Latest Framelink vulnerabilities

  • 9.8 Critical severity

    Figma MCP Server: Improper Neutralization of Special Elements used in an OS Command

    CVE-2025-15061FramelinkEPSS 2.18%

    Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Framelink Figma MCP Server. Authentication is not required to exp

  • 8.0 High severity

    Figma MCP Server: Unprotected Alternate Channel

    CVE-2025-53967FramelinkEPSS 6.61%

    Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable en