Figma Console (mp3wizard) MCP Server

This server (without client built-ins) exposes a complete data-exfiltration chain: figma_get_file_at_version → figma_get_token_values → figma_export_tokens. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.

Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.

Location: flow figma_get_file_at_version → figma_get_token_values → figma_export_tokens

In the server's implementation (`figma-desktop-bridge/code.js:519`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: E codePromise = eval(wrappedCode); } catch (syntaxError) { // Log the actual syntax error message

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server figma-desktop-bridge/code.js

The implementation both builds shell commands out of runtime values (`dist/core/port-discovery.js`) and evaluates runtime values as code (`figma-desktop-bridge/code.js`). Each is a separate arbitrary-execution primitive; a server exposing both gives anything that reaches either one a direct path to running attacker-chosen code. These two sinks are in different files — confirm whether they are actually connected, or are unrelated code paths (e.g. a vendored bundle plus a CLI wrapper).

Fix: Remove the dynamic eval, and pass command arguments as an argv array instead of building a shell string. If both are genuinely required, constrain and validate every value that can reach them.

Location: server implementation

In the server's implementation (`figma-desktop-bridge/code.js:519`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: E codePromise = eval(wrappedCode); } catch (syntaxError) { // Log the actual syntax error message

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server figma-desktop-bridge/code.js

In the server's implementation (`dist/core/history/git-history.js:124`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ckIgnore: true */ "node:child_process"); const execFile = mod.execFile; if (typeof execFile !== "function") {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/history/git-history.js

In the server's implementation (`dist/core/port-discovery.js:35`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e, execFileSync } from 'child_process'; import { promisify } from 'util'; import { createChildLogger } from './logger.js

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/port-discovery.js

In the server's implementation (`dist/core/port-discovery.js:388`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: '); const out = execSync(`ps -p ${pid} -o etime= 2>/dev/null`, { encoding: 'utf-8', time

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/core/port-discovery.js