EUVD-2024-1313

Malicious code in bioql PyPI...

EUVD-2025-27581

Malicious code in bioql PyPI...

EUVD-2022-25212

Malicious code in bioql PyPI...

EUVD-2024-50451

Malicious code in bioql PyPI...

EUVD-2024-1586

Malicious code in bioql PyPI...

EUVD-2025-31106

Malicious code in bioql PyPI...

EUVD-2023-2809

Malicious code in bioql PyPI...

EUVD-2022-0909

Malicious code in bioql PyPI...

EUVD-2025-30670

Malicious code in bioql PyPI...

EUVD-2023-35293

Malicious code in bioql PyPI...

EUVD-2025-25108

Malicious code in bioql PyPI...

EUVD-2024-38708

Malicious code in bioql PyPI...

EUVD-2024-2695

Malicious code in bioql PyPI...

EUVD-2023-58792

Malicious code in bioql PyPI...

EUVD-2025-23144

Malicious code in bioql PyPI...

EUVD-2023-1899

Malicious code in bioql PyPI...

Arbitrary Command Injection

Overview figma-developer-mcp is a Give your coding agent access to your Figma data. Implement designs in any framework in one-shot. Affected versions of this package are vulnerable to Arbitrary Command Injection via the childprocess.exec call using unvalidated user input directly within...

GHSA-GXW4-4FC5-9GR5 figma-developer-mcp vulnerable to command injection in get_figma_data tool

Summary A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote...

figma-developer-mcp vulnerable to command injection in get_figma_data tool

Summary A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote...

PT-2025-40054

Name of the Vulnerable Software and Affected Versions Framelink Figma MCP Server versions prior to 0.6.3 Figma-developer-mcp versions prior to 0.6.3 Description A command injection flaw exists in the Framelink Figma MCP Server, allowing an unauthenticated remote attacker to execute arbitrary...