An unauthenticated command injection vulnerability in the Framelink Figma MCP Server enables remote attackers to execute arbitrary system commands, posing a high risk of system compromise.

This vulnerability occurs due to improper sanitization of user-supplied input within the fetchWithRetry curl command, allowing an unauthenticated remote attacker to inject shell metacharacters via a crafted HTTP POST request. The malicious commands are executed with the privileges of the MCP process.

Successful exploitation allows an attacker to achieve remote code execution on the underlying host, which may result in full system compromise, unauthorized data access, and lateral movement within the network. With a CVSS score of 8.0, this vulnerability is classified as High severity, necessitating immediate attention to prevent unauthorized control over the affected infrastructure.

Immediate Action: Update the Figma MCP Server to version 0.6.3 or later to incorporate the necessary input sanitization patches.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed at the MCP interface, particularly those containing shell characters such as semicolons, pipes, or backticks.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block malicious payloads containing command injection patterns before they reach the application interface.

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up provided in the referenced GitHub repository.

Given the capability for remote code execution and the availability of proof-of-concept information, this vulnerability poses a significant risk to organizational assets. Administrators must prioritize the upgrade to version 0.6.3 immediately to eliminate the injection vector and secure the application environment against potential exploitation.