Figma MCP Server vulnerabilities

2 known vulnerabilities in Figma MCP Server from Framelink. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Figma MCP Server: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-15061Jan 23, 2026FramelinkEPSS 2.18%

  Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Framelink Figma MCP Server. Authentication is not required to exp

• 8.0 High severity

  Figma MCP Server: Unprotected Alternate Channel

  CVE-2025-53967Oct 8, 2025FramelinkEPSS 6.61%

  Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable en