PT-2025-53840 · Unknown · Framelink Figma Mcp Server

Published 2025-09-30 · Updated 2026-03-07 · CVE-2025-15061

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Framelink Figma MCP Server (affected versions not specified)

Description This issue allows remote attackers to execute arbitrary code on affected installations of Framelink Figma MCP Server without authentication. The flaw resides within the fetchWithRetry method due to insufficient validation of user-supplied strings before they are used in system calls. An attacker can exploit this to execute code with the privileges of the service account. The vulnerability is related to command injection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2025-15061

GHSA-GXW4-4FC5-9GR5

ZDI-25-1197

Affected Products

Framelink Figma Mcp Server

References · 14

• https://github.com/GLips/Figma-Context-MCP/security/advisories/GHSA-gxw4-4fc5-9gr5 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-1197 · Security Note
• https://osv.dev/vulnerability/GHSA-gxw4-4fc5-9gr5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-15061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15061 · Security Note
• https://github.com/GLips/Figma-Context-MCP · Note
• https://github.com/GLips/Figma-Context-MCP/commit/7f4b5859454b0567c2121ff22c69a0344680b124 · Note
• https://twitter.com/0dayPublishing/status/2014547728722796774 · Twitter Post
• https://twitter.com/ai_security_10x/status/2030181739138793629 · Twitter Post
• https://twitter.com/TheZDIBugs/status/2008259794197483650 · Twitter Post
• https://twitter.com/vituu/status/2015912689948557562 · Twitter Post
• https://twitter.com/Absolcasso/status/2030343021146132636 · Twitter Post
• https://twitter.com/CVEnew/status/2014576966779941256 · Twitter Post
• https://t.me/cveNotify/149646 · Telegram Post