{"action":"Upgrade figma-developer-mcp to 0.6.3 or later.","affected":[{"fixed":"0.6.3","introduced":"0"}],"component":"figma-developer-mcp","cve_ids":["CVE-2025-15061","CVE-2025-53967"],"ecosystem":"npm","epss":0.02178,"exploited":false,"fixed_versions":["0.6.3"],"ghsa_id":"GHSA-gxw4-4fc5-9gr5","id":"tcs_01M5KFSSGN3E61K6XJCCNVMXH4","modified_at":"2026-10-08T02:56:07.754160239Z","published_at":"2025-09-30T17:01:42Z","references":["https://osv.dev/vulnerability/GHSA-gxw4-4fc5-9gr5","https://github.com/GLips/Figma-Context-MCP/security/advisories/GHSA-gxw4-4fc5-9gr5","https://github.com/GLips/Figma-Context-MCP/commit/7f4b5859454b0567c2121ff22c69a0344680b124","https://github.com/GLips/Figma-Context-MCP"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-gxw4-4fc5-9gr5","url":"https://osv.dev/vulnerability/GHSA-gxw4-4fc5-9gr5"}],"summary":"figma-developer-mcp vulnerable to command injection in get_figma_data tool"}