Figma MCP Server CVE-2025-53967

The attacker must be able to reach the MCP server's HTTP transport and submit input that flows into the fetchWithRetry curl command; in versions before 0.6.3 the HTTP server was not restricted to localhost, so it could be network-reachable without authentication. No credentials, user interaction, or special feature toggles beyond running the HTTP server mode are required. The key limiting factor is network exposure: because MCP servers are commonly bound to the local machine (and 0.6.3 enforces localhost-only binding), realistic exploitation depends on the server being exposed to the attacker's network segment or host.

This is an unauthenticated OS command injection (CWE-420 / command injection) in a popular developer-facing MCP server, placing it toward the genuine-priority end rather than high-CVSS-but-low-real-risk. Signals partly align and partly conflict: the input CVSS of 8.0 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) confirms no privileges and no user interaction, but understates the vuln by choosing AV:A (adjacent), AC:H, and A:N - for a simple shell-metacharacter injection reaching a curl command, AV:N/AC:L with availability impact is more defensible (see assessed vectors). EPSS is elevated at 5.83% (93rd percentile), indicating above-average predicted exploitation likelihood, consistent with a straightforward, well-documented RCE. The Imperva research writeup publicly details the RCE, so technique knowledge is in the open, but per the precision rules there is no POC=YES or KEV flag in the input, so this is scored as 'no public exploit identified at time of analysis' and NOT active exploitation. The main real-world mitigant is deployment pattern: MCP servers are typically run locally by individual developers, and the 0.6.3 fix binds the HTTP server to localhost - so widespread internet-facing exposure is likely limited, suggesting opportunistic or local-network risk more than mass remote exploitation.

An attacker who can reach the Framelink Figma MCP Server HTTP endpoint (pre-0.6.3 the server was not restricted to localhost) sends a crafted HTTP POST containing shell metacharacters in a field that flows into the fetchWithRetry curl invocation. The unsanitized input breaks out of the intended command and executes arbitrary OS commands with the privileges of the MCP process, yielding host compromise. No POC is flagged in the input, though Imperva has published a technical analysis of the RCE.