CVE-2025-56803

HIGH

Figma Desktop 125.6.5 - OS Command Injection via Plugin Manifest Build Field

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-56803. PoCs published by shinyColumn, yosasasutsut.

AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2025-56803, an OS command injection vulnerability in Figma Desktop Application version 125.6.5. The exploit leverages the `build` field in a plugin's `manifest.json` to execute arbitrary commands via `child_process.exec()` without validation.

Description

Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to child_process.exec without validation, leading to possible RCE. NOTE: this is disputed by the Supplier because the behavior only allows a local user to attack himself via a local plugin. The local build procedure, which is essential to the attack, is not executed for plugins shared to the Figma Community.

Exploits (2)

nomisec WORKING POC 1 stars
by shinyColumn · poc
https://github.com/shinyColumn/CVE-2025-56803

This repository contains a proof-of-concept for CVE-2025-56803, an OS command injection vulnerability in Figma Desktop Application version 125.6.5. The exploit leverages the `build` field in a plugin's `manifest.json` to execute arbitrary commands via `child_process.exec()` without validation.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Figma Desktop Application 125.6.5
No auth needed
Prerequisites: Figma Desktop Application 125.6.5 installed · Ability to load a malicious plugin via manifest import
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by yosasasutsut · poc
https://github.com/yosasasutsut/CVE-2025-56803

This repository contains a functional proof-of-concept exploit for CVE-2025-56803, targeting a vulnerability in Figma plugins. The exploit leverages a malicious plugin configuration to execute arbitrary code via a crafted 'build' field in the manifest.json file.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Figma (plugin system)
No auth needed
Prerequisites: User interaction to install the malicious plugin
devstral-2 · analyzed May 24, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory
https://github.com/shinyColumn/CVE-2025-56803

Scores

CVSS v3 8.4
EPSS 0.0106
EPSS Percentile 60.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
figma/desktop 125.6.5
Published Sep 03, 2025
Tracked Since Feb 18, 2026