EUVD-2025-23144

Malicious code in bioql PyPI...

EUVD-2023-25402

Malicious code in bioql PyPI...

EUVD-2024-1358

Malicious code in bioql PyPI...

EUVD-2024-22182

Malicious code in bioql PyPI...

EUVD-2024-1313

Malicious code in bioql PyPI...

EUVD-2023-29638

Malicious code in bioql PyPI...

EUVD-2024-46495

Malicious code in bioql PyPI...

EUVD-2025-30670

Malicious code in bioql PyPI...

EUVD-2024-18847

Malicious code in bioql PyPI...

EUVD-2022-25212

Malicious code in bioql PyPI...

EUVD-2023-35293

Malicious code in bioql PyPI...

EUVD-2022-7111

Malicious code in bioql PyPI...

EUVD-2022-33946

Malicious code in bioql PyPI...

EUVD-2024-34422

Malicious code in bioql PyPI...

EUVD-2024-48206

Malicious code in bioql PyPI...

EUVD-2023-33698

Malicious code in bioql PyPI...

Arbitrary Command Injection

Overview figma-developer-mcp is a Give your coding agent access to your Figma data. Implement designs in any framework in one-shot. Affected versions of this package are vulnerable to Arbitrary Command Injection via the childprocess.exec call using unvalidated user input directly within...

figma-developer-mcp vulnerable to command injection in get_figma_data tool

Summary A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote...

GHSA-GXW4-4FC5-9GR5 figma-developer-mcp vulnerable to command injection in get_figma_data tool

Summary A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote...

PT-2025-40046

Summary A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child process.exec, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote...