Disclosed vulnerability
Command injection in the Framelink Figma MCP server (figma-developer-mcp)
AIR-2025-0147 AIR record · 2025-10-koi-figma-mcp-command-injection
From the supporting source
The combination of unauthenticated access and exploitable code like command injection creates a perfect storm for remote code execution.koi.ai
The record
Disclosed
2025-10-10
Vendor
Framelink
Product
figma-developer-mcp (Framelink Figma MCP server) < 0.6.3
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
AI was the target (contested) — unsanitized curl command in an MCP server reachable unauthenticated
Attack surface
MCP server
Autonomy level
Semi-autonomous
Initial vector
Unauthenticated network request
Impact type
Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Nearly 1 million downloads; server binds all interfaces on port 3333 by default
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
v0.6.3, released 2025-09-29
Taxonomy & references
Curator notes
Authors Lotan Sery and Idan Dardikman. Sink is an unsanitized curl command built in fetchWithRetry.
Supporting sources
Cite as
Enkrypt AI. "Command injection in the Framelink Figma MCP server (figma-developer-mcp)". AIR, AIR-2025-0147. https://agentincident.vercel.app/i/AIR-2025-0147/ (accessed 2026-10-19).