Figma Developer MCP < 0.6.3 RCE (GHSA-gxw4-4fc5-9gr5)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271839);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/05");

  script_cve_id("CVE-2025-53967");

  script_name(english:"Figma Developer MCP < 0.6.3 RCE (GHSA-gxw4-4fc5-9gr5)");
  
  script_set_attribute(attribute:"synopsis", value:
"The remote host has a vulnerable figma-developer-mcp module installed.");
  script_set_attribute(attribute:"description", value:
"The remote host has a version of figma-developer-mcp prior to 0.6.3.  A command injection vulnerability exists 
in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters 
within a call to child_process.exec, enabling an attacker to inject arbitrary system commands. Successful 
exploitation can lead to remote code execution under the server process's privileges.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/advisories/GHSA-gxw4-4fc5-9gr5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7de2a2e1");
  script_set_attribute(attribute:"solution", value:
"Update to version 0.6.3 or higher");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-53967");
  script_cwe_id(77);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/28");
  
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:nodejs:figma-developer-mcp");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Artificial Intelligence");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'figma-developer-mcp');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'figma-developer-mcp');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'fixed_version':'0.6.3' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);