# Framelink Figma MCP Server curl-Fallback Command Injection (CVE-2025-53967)

- **Severity:** High
- **Signature ID:** `bcf354f1-f033-4d6e-a7a2-3393671f202c`
- **CVEs:** CVE-2025-53967
- **MITRE ATLAS:** AML.T0051.001 (Indirect), AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI05 (Cascading Failures in Multi-Agent Systems), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

The Framelink Figma MCP server has a bug in how it retries failed network requests. When a normal fetch fails, it falls back to calling the curl command through the system shell, and it pastes the target URL into that command without checking it for special characters. Anyone who can put text into a Figma file name, text layer, or component description can hide shell commands there and get them executed on the server.

## How the attack works

An attacker plants shell metacharacters (like $(...), ;, or &&) inside a Figma file name, a text layer, or a component description. When an AI agent using the Framelink Figma MCP server later fetches that content and the initial HTTP fetch fails, the server falls back to building a curl command from the raw URL string. Because the URL is concatenated straight into a shell exec call without sanitization, the attacker's hidden shell syntax runs as an actual command on the host running the MCP server. This gives the attacker arbitrary command execution, triggered indirectly through content the agent was only supposed to read.

## Why it matters

An attacker can achieve arbitrary command execution on the machine running the Figma MCP server just by planting malicious text in a Figma design file, without needing direct access to the server itself.

## What you can do

- Update the Framelink Figma MCP server to a patched version that removes or sanitizes the curl fallback in fetch-with-retry.ts.
- If patching isn't possible yet, disable the curl fallback path or restrict the MCP server's ability to execute shell commands.
- Treat Figma file names, text layers, and component descriptions as untrusted input; sanitize or reject values containing shell metacharacters like $(), backticks, ;, or && before they reach any exec call.
- Run the MCP server with least-privilege permissions and without shell access to limit damage if this path is triggered again.

## Known benign look-alikes

- Generic install-doc curl pipelines such as "curl https://example.com/install.sh | bash", nvidia-skill setup docs, or vercel agent-API docs that contain curl or a URL with & query separators but do NOT name the Framelink/Figma MCP curl-fallback sink (figma/framelink + fetch-with-retry / child_process.exec) are benign and must not fire. Both the figma/framelink anchor AND the exec/curl-fallback sink must be present.
- Normal HTTP(S) URLs that use & to separate query-string parameters (?a=1&b=2), and shell variable interpolation in config templates such as ${BASE} or ${FIGMA_FILE_KEY}, are benign env substitution -- not command substitution $(...) -- and are excluded.
- Patch-discussion, advisory, and research text that merely names CVE-2025-53967, fetch-with-retry.ts, or the curl fallback without carrying a live injected URL payload does not match.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01928
- https://www.imperva.com/blog/another-critical-rce-discovered-in-a-popular-mcp-server/
- https://nvd.nist.gov/vuln/detail/CVE-2025-53967

---
Source: https://www.netzilo.com/threats/atr-framelink-figma-mcp-server-curl-fallback-command-injection-c