CVE-2025-15061

Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Framelink Figma MCP Server. Authentication is not required to exploit this vulnerability. The specific...

The vulnerability of the MCP-server Framelink Figma MCP Server lies in the use of an unprotected alternative channel, allowing attackers to execute arbitrary commands.

The vulnerability of the MCP-server Framelink Figma MCP Server is related to the use of an unprotected alternative channel. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2025-53967

Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize...