CVE-2025-15061: Critical Command Injection in Framelink Figma MCP Server

A critical remote code execution vulnerability has been discovered in the Framelink Figma MCP Server (CVE-2025-15061), exposing AI agent deployments to unauthenticated command injection attacks. This vulnerability in the fetchWithRetry method allows attackers to execute arbitrary commands on vulnerable systems, highlighting the security risks inherent in reference implementation servers.

How the Command Injection Attack Works

The vulnerability resides in the fetchWithRetry method implementation, where user-supplied input is improperly sanitized before being passed to system command execution functions. Attackers can craft malicious input that includes shell command separators (like semicolons or backticks) that get interpreted by the underlying operating system shell. This allows execution of arbitrary commands with the privileges of the running MCP server process, potentially leading to full system compromise.

Command injection vulnerabilities typically occur when developers use unsafe functions like os.system() or subprocess.call() without proper input validation and sanitization. In this case, the Framelink Figma MCP server failed to properly validate URL parameters or command arguments before passing them to underlying system calls.

Implications for AI Agent Deployments

This vulnerability demonstrates the critical importance of securing MCP server implementations, particularly those handling external data sources or user inputs. AI agents relying on vulnerable MCP servers can become entry points for attackers to compromise entire deployment environments. The attack requires no authentication, making any exposed server immediately vulnerable.

Reference implementation servers, like those in the MCP servers repository, are explicitly documented as educational examples rather than production-ready solutions. However, developers often deploy them directly without implementing proper security hardening, creating widespread exposure.

Defensive Measures and Code Examples

Implementing proper input validation and secure coding practices is essential for preventing command injection attacks. Here's an example of secure command execution using the Python subprocess module with proper input sanitization:

import subprocess
import shlex

def safe_fetch_url(url):
    # Validate URL format using allowlist approach
    if not url.startswith(('http://', 'https://')):
        raise ValueError("Invalid URL scheme")

    # Use shlex.quote to sanitize input
    safe_url = shlex.quote(url)

    # Execute command without shell=True to prevent injection
    result = subprocess.run(['curl', safe_url], 
                          capture_output=True, 
                          text=True,
                          check=False)
    return result.stdout

Additional defensive measures include: - Implementing OAuth 2.1 authentication for MCP servers - Using parameterized APIs instead of command execution - Running MCP servers with minimal privileges - Implementing network-level access controls

Immediate Action Steps

If you're using the Framelink Figma MCP Server or any similar reference implementation:

1. Immediately update to the latest patched version
2. Audit all MCP server deployments for similar vulnerabilities
3. Implement authentication using OAuth 2.1 as shown in the MCP SDK documentation
4. Restrict network access to MCP servers using firewall rules
5. Monitor for suspicious activity on systems running MCP servers

Reference implementation servers serve educational purposes but require significant hardening before production deployment. Always treat external inputs as potentially malicious and implement multiple layers of validation and sanitization.

Source: NVD CVE-2025-15061