npmPackage

figma-developer-mcp

2 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2025-15061Critical 9.8
Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability
Affected: fixed in 0.6.3.
Fixed in 0.6.3 (released Sep 29, 2025, 116 days before disclosure).
The latest release, 0.13.2, is not affected.
1.3% of figma-developer-mcp downloads last week were affected versions (2.1K).
CVE-2025-53967High 8.0
Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a…
Affected: fixed in 0.6.3.
Fixed in 0.6.3 (released Sep 29, 2025, 9 days before disclosure).
The latest release, 0.13.2, is not affected.
1.3% of figma-developer-mcp downloads last week were affected versions (2.1K).