Figma MCP Server Opens Orgs to Agentic AI Compromise

A high‑severity vulnerability in Figma’s MCP server could allow remote code execution by passing unvalidated input to shell commands, researchers say, via the figma-developer-mcp npm package bug CVE-2025-53967. According to the advisory posted on GitHub, the issue arises from a lack of input validation and sanitisation, enabling indirect prompt injection and command injection when the get_figma_data tool is used.

The security risk is significant because MCP servers connect Figma designers to AI code generators and other enterprise systems, potentially enabling attackers to execute commands with server privileges and compromise multiple connected systems. Dark Reading notes that the patch replaces child_process.exec() with child_process.execFile() and calls for immediate upgrades to Figma MCP version 0.6.3 or higher, plus audits and log reviews for suspicious command execution patterns.

The article situates the flaw within broader concerns about the rapid adoption of MCP servers and agentic AI, highlighting ongoing misconfigurations and the need for secure implementations across organisations. October 8, 2025.