Severe Figma MCP Vulnerability Lets Hackers Execute Code Remotely — Patch Now

Cybersecurity researchers disclosed a now-patched vulnerability in the figma-developer-mcp Model Context Protocol (MCP) server that could allow attackers to achieve remote code execution, tracked as CVE-2025-53967 with a CVSS score of 7.5. The flaw stems from the unsanitised use of user input to construct and execute shell commands, enabling potential shell metacharacter injection and arbitrary commands, according to a GitHub advisory.

Given that the Framelink Figma MCP server exposes AI-powered coding agents like Cursor to perform operations in Figma, an attacker could trigger unintended actions via indirect prompt injection. Imperva, which discovered and reported the issue in July 2025, described CVE-2025-53967 as a design oversight in the fallback mechanism that could allow full remote code execution, putting developers at risk of data exposure; Imperva’s assessment was reported by The Hacker News.

The vulnerability has been addressed in figma-developer-mcp version 0.6.3, released on 29 September 2025, and mitigations include avoiding child_process.exec with untrusted input and using child_process.execFile instead.