Unprotected Alternate Channel

Summary

A Command Injection vulnerability exists in the "get_figma_data tool" of the figma-developer-mcp MCP Server. Unsanitized, attacker-controlled input is interpolated into a shell-invoking "child_process.exec" call, allowing injection of shell metacharacters and arbitrary system commands. Successful exploitation may result in remote code execution with the privileges of the server process, data disclosure, tampering, or Denial-of-Service. This issue affects figma-developer-mcp versions prior to 0.6.3.