11 matches found
CVE-2025-56803
CVE-2025-56803 Figma桌面应用程序中的插件执行OS命令注入漏洞 1. 概述 应用程序 ：Figma桌面应用程序 版本 ：125.6.5 供应商 ：Figma, Inc. CWE ：CWE-78：OS命令中特殊元素的不当中和（'OS命令注入'） CVSS ：8.4 向量字符串 ：CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2. 摘要 Figma桌面应用程序（v125.6.5）在插件加载器中存在命令注入漏洞。...
📄 Figma Desktop Application 125.6.5 Remote Code Execution
Figma Desktop Application version 125.6.5 proof of concept remote code execution exploit that leverages the plugin manifest. ============================================================================================================================================= | Title : Figma Desktop...
EUVD-2025-26625
Malicious code in bioql PyPI...
CVE-2025-56803
Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to childprocess.exec without validation, leading to...
CVE-2025-56803
Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to childprocess.exec without validation, leading to...
Figma Desktop 安全漏洞
Figma Desktop is a vector graphics editor and prototyping tool from Figma. A security vulnerability exists in Figma Desktop version 125.6.5, which stems from a command injection vulnerability in the local plugin loader that could lead to remote code execution...
CVE-2025-56803
Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability within the local plugin loader. The root cause is the lack of validation for the build field in a plugin's manifest.json file, which is passed directly to Node.js's child_process.exec() in main.js. This allows an...
CVE-2025-56803
Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to childprocess.exec without validation, leading to...
PT-2025-35802
Name of the Vulnerable Software and Affected Versions: Figma Desktop versions 125.6.5 Description: Figma Desktop for Windows version 125.6.5 contains a command injection issue in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin'...
CVE-2025-56803
Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to childprocess.exec without validation, leading to...
