EUVD-2026-4488Published
Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2025-15061 · Microsoft / collected KEV context
CVE-2025-53967 · Microsoft / collected KEV context
cve-program · CVE-2025-15061
- https://www.zerodayinitiative.com/advisories/ZDI-25-1197/
- https://github.com/GLips/Figma-Context-MCP/security/advisories/GHSA-gxw4-4fc5-9gr5
cve-program · CVE-2025-53967
- https://github.com/GLips/Figma-Context-MCP/blob/96b3852669c5eed65e4a6e20406c25504d9196f2/src/utils/fetch-with-retry.ts#L34
- https://www.imperva.com/blog/another-critical-rce-discovered-in-a-popular-mcp-server/
- https://github.com/GLips/Figma-Context-MCP/releases/tag/v0.6.3
euvd · EUVD-2025-31753
- https://github.com/GLips/Figma-Context-MCP/blob/96b3852669c5eed65e4a6e20406c25504d9196f2/src/utils/fetch-with-retry.ts#L34
- https://www.imperva.com/blog/another-critical-rce-discovered-in-a-popular-mcp-server/
- https://github.com/GLips/Figma-Context-MCP/releases/tag/v0.6.3
euvd · EUVD-2026-4488
- https://www.zerodayinitiative.com/advisories/ZDI-25-1197/
- https://github.com/GLips/Figma-Context-MCP/security/advisories/GHSA-gxw4-4fc5-9gr5
nvd · CVE-2025-15061
- https://github.com/GLips/Figma-Context-MCP/security/advisories/GHSA-gxw4-4fc5-9gr5
- https://www.zerodayinitiative.com/advisories/ZDI-25-1197/
nvd · CVE-2025-53967
- https://github.com/GLips/Figma-Context-MCP/blob/96b3852669c5eed65e4a6e20406c25504d9196f2/src/utils/fetch-with-retry.ts#L34
- https://github.com/GLips/Figma-Context-MCP/releases/tag/v0.6.3
- https://www.imperva.com/blog/another-critical-rce-discovered-in-a-popular-mcp-server/
osv · GHSA-gxw4-4fc5-9gr5
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.