
- CVE-2025-53967 allows remote code execution via figma-developer-mpc command injection flaw
- Vulnerability stems from unvalidated input passed to shell commands using child_process.exec
- Users should upgrade to version 0.6.3 or switch to safer child_process.execFile API
A vulnerability has been found on the bridge between Figma and AI agents which could be used to remotely execute malicious code on compromised endpoints, experts have warned.