CVE-2025-56803
HIGHFigma Desktop 125.6.5 - OS Command Injection via Plugin Manifest Build Field
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-56803. PoCs published by shinyColumn, yosasasutsut.
AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2025-56803, an OS command injection vulnerability in Figma Desktop Application version 125.6.5. The exploit leverages the `build` field in a plugin's `manifest.json` to execute arbitrary commands via `child_process.exec()` without validation.
Description
Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to child_process.exec without validation, leading to possible RCE. NOTE: this is disputed by the Supplier because the behavior only allows a local user to attack himself via a local plugin. The local build procedure, which is essential to the attack, is not executed for plugins shared to the Figma Community.
Exploits (2)
This repository contains a proof-of-concept for CVE-2025-56803, an OS command injection vulnerability in Figma Desktop Application version 125.6.5. The exploit leverages the `build` field in a plugin's `manifest.json` to execute arbitrary commands via `child_process.exec()` without validation.
This repository contains a functional proof-of-concept exploit for CVE-2025-56803, targeting a vulnerability in Figma plugins. The exploit leverages a malicious plugin configuration to execute arbitrary code via a crafted 'build' field in the manifest.json file.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H