CVE-2025-53967: figma-developer-mcp command injection (<= 0.6.2)
Community MCP server, not an official Figma product.
Maintained by GitHub user GLips (repository GLips/Figma-Context-MCP), as given in the advisory.
- Product
- figma-developer-mcp (npm)
- CVE
- CVE-2025-53967
- Affected
- <= 0.6.2
- Fixed in
- 0.6.3
Last verified against sources: October 16, 2026
What happened
- According to GitHub Advisory Database's advisory (Sept 30, 2025), the figma-developer-mcp server passed unsanitized input parameters to child_process.exec, letting an attacker inject system commands. [1]
Impact
- Remote code execution with the server process's privileges (CVSS 7.5). [1]
What was done
- Fixed in version 0.6.3. [1]
How to protect yourself
- Upgrade figma-developer-mcp to 0.6.3 or later. [1]
Sources
- GHSA-gxw4-4fc5-9gr5 — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Corrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.