child_process.exec

Patched command injection in Figma MCP server could allow remote code execution, researchers say

News, Research, Vendors, Vulnerabilities

October 8, 2025

A command injection bug in the figma-developer-mcp Model Context Protocol server, tracked as CVE-2025-53967 and scored 7.5, could allow remote code execution by interpolating unvalidated input into shell commands; the issue was fixed in version 0.6.3 and researchers recommend avoiding child_process.exec with untrusted data.