CVE-2025-53967: Unauthenticated Command Injection Leading to Full Remote Code Execution in Framelink Figma MCP Server

Vulnerability Overview

CVE ID: CVE-2025-53967
Affected Product: Framelink Figma MCP Server (figma-developer-mcp)
Vulnerability Type: OS Command Injection
Attack Type: Remote
Authentication Required: None
Impact: Remote Code Execution (RCE)
CVSS v3.1 Score: 8.0
Severity: High
Exploit Maturity: Proof-of-concept available (educational / testing use)
User Interaction: Not required

Executive Summary

A high-severity command injection vulnerability exists in the Framelink Figma MCP Server. Due to improper handling of user-supplied input, arbitrary operating system commands may be executed on the host running the MCP service. Exploitation does not require authentication and may be performed remotely if the MCP server is exposed to a network.

The vulnerability arises from unsafe construction and execution of shell commands using unsanitized input parameters. An attacker can inject shell metacharacters into specific request fields, resulting in full command execution under the privileges of the MCP service process.

If exploited, this issue may lead to complete system compromise, including unauthorized file access, data exfiltration, credential theft, lateral movement, and persistence installation.

Affected Versions

All versions of figma-developer-mcp prior to v0.6.3

Root Cause Analysis

The vulnerability is caused by improper neutralization of special characters when user input is passed to a shell command.

Internally, the MCP server constructs a system command (using tools such as curl) by concatenating user-controlled input into a command string. This command string is then executed using a shell execution method.

Because shell execution is performed without strict input validation or argument separation, special characters such as:

$()
backticks `
;
|
&&
>, <

are interpreted by the operating system shell instead of being treated as literal data.

As a result, arbitrary commands supplied by an attacker are executed directly on the host.

Attack Surface

The attack surface includes:

MCP server HTTP interface
JSON-RPC endpoints (e.g., tools/call)
Any deployment where the MCP service is:
- bound to a non-localhost interface
- reachable from local networks, CI/CD pipelines, containers, or developer workstations

Exploitation Details (Educational)

Exploitation Method

Exploitation is performed by sending a crafted request to the MCP server containing shell metacharacters within a parameter that is later embedded into a system command.

A commonly abused parameter is one used to identify Figma file resources. When this parameter is injected with shell syntax, arbitrary commands are executed.

Proof-of-Concept (PoC)

Note: The following information is provided strictly for educational, testing, and defensive purposes.

An attacker may send a JSON-RPC request similar to the following:

{
  "method": "tools/call",
  "params": {
    "name": "get_figma_data",
    "arguments": {
      "fileKey": "$(id > /tmp/poc_test)"
    }
  }
}

Result

The injected command is executed by the operating system.
A file such as /tmp/poc_test is created.
The contents of the file confirm execution of the injected command.

This demonstrates successful remote code execution.

Impact Assessment

If successfully exploited, the following impacts should be expected:

Arbitrary command execution
Unauthorized file creation or modification
Exposure of environment variables and API keys (including Figma tokens)
Access to source code, credentials, and secrets
Pivoting into internal networks
Compromise of CI/CD pipelines
Persistence mechanisms installed on host

The level of damage depends on the privileges under which the MCP server process is running.

MITRE ATT&CK Mapping

CWE-77: Improper Neutralization of Special Elements used in a Command
ATT&CK Techniques:
- T1190 – Exploit Public-Facing Application
- T1059 – Command and Scripting Interpreter

Detection and Monitoring Guidance

Primary Log Sources to Monitor

MCP application logs
HTTP access logs (reverse proxy, Node.js server)
Host process execution logs
File integrity monitoring logs
EDR / Sysmon / auditd logs
Container runtime logs (if applicable)

Indicators of Compromise (IOCs)

The following patterns should be treated as suspicious when observed in requests or logs:

$( or )
Backticks `
&&, ||, |
Output redirection operators > or <
Unexpected shell commands embedded in JSON values
File creation in /tmp, /var/tmp, or user home directories
node or npx spawning shell processes unexpectedly

Detection Logic

HTTP Payload Detection

Trigger alerts when:

HTTP POST requests target MCP tool endpoints
JSON request bodies contain shell metacharacters
Fields such as fileKey contain unexpected symbols or command strings

Host-Based Detection

Monitor for:

Child processes spawned by node or npx
Execution of sh, bash, or curl by MCP service
Unusual file creation activity by MCP service account

Recommended Mitigation and Remediation

Immediate Actions

Upgrade the MCP server to the fixed version immediately
Restrict MCP service exposure to localhost where possible
Block external access using firewall or network policies
Rotate API keys and credentials used by the service

Official Patch / Upgrade

The vulnerability is fully resolved by upgrading to figma-developer-mcp version 0.6.3 or later.

Official upgrade link:
👉 https://github.com/GLips/Figma-Context-MCP/releases/tag/v0.6.3

Long-Term Hardening Recommendations

Avoid shell execution with user input
Replace shell-based execution with argument-based process execution
Enforce strict input validation
Implement allow-listing for parameters
Enable application-level logging for command execution paths
Regularly audit developer tooling exposed on networks

Final Takeaway

This vulnerability highlights the risks associated with exposing developer tooling without strict access controls and input validation. Even tools intended for local or internal use can become high-risk when deployed improperly.

Organizations running the Framelink Figma MCP Server should treat this issue as a high-priority remediation item and ensure patching and monitoring are completed without delay.