CVE-2025-56803

Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to child_process.exec without validation, leading to possible RCE. NOTE: this is disputed by the Supplier because the behavior only allows a local user to attack himself via a local plugin. The local build procedure, which is essential to the attack, is not executed for plugins shared to the Figma Community.

• CWE-78

• https://github.com/shinyColumn/CVE-2025-56803Exploit, Third Party Advisory
• https://shinycolumn.notion.site/figma-command-injectionExploit, Third Party Advisory

Published

Sep 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-56795Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site …9
• CVE-2025-56799Reolink desktop application 8.18.12 contains a command injec…6.5
• CVE-2025-5680A vulnerability classified as critical was found in Shenzhen…8.8
• CVE-2025-56800Reolink desktop application 8.18.12 contains a vulnerability…5.1
• CVE-2025-56801The Reolink Desktop Application 8.18.12 contains hardcoded c…5.1
• CVE-2025-56802The Reolink desktop application uses a hard-coded and predic…5.1
• CVE-2025-56807A cross-site scripting (XSS) vulnerability in FairSketch RIS…6.1
• CVE-2025-5681Authorization Bypass Through User-Controlled Key vulnerabili…6.5
• CVE-2025-56814A code injection vulnerability in the wxExecute() function o…7.8
• CVE-2025-56815Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in th…7.1
• CVE-2025-56816Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The …8.8
• CVE-2025-56819An issue in Datart v.1.0.0-rc.3 allows a remote attacker to …9.8