Framelink Figma MCP RCE
Date: 2025-10
Affected: Framelink Figma MCP RCE
Attack vector: rce
Category: real-world
Severity: Critical
CVE: CVE-2025-15061
CVE-2025-53967
CWE: CWE-420
CWE-78
CVSS:  (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Unsanitized user input in Framelink Figma MCP’s `get_figma_data` tool enabled unauthenticated remote command execution on host systems.


Mitigations:

Architectural layers (MAESTRO):