Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

glips/figma-context-mcp

              main @ c083d65
            

Fixes

CVEs

CRITICAL

Peak severity

57.1%

Coverage

Highlights

Path Traversal: 3 prior fixes. Scrutinize any change in this area.

src/mcp/tools/download-figma-images-tool.ts: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Attackers can supply malicious path sequences to escape target directories and write arbitrary files locally during Figma image downloads. Proper prefix validation using canonicalized paths is critical to defend this operation.

Command Injection: Using shell execution patterns to download assets exposes the application to command injection via untrusted URLs or HTTP header inputs. The system must completely avoid shell-interpreting functions.

Information Disclosure: Figma API keys and OAuth tokens can leak to telemetry platforms (like PostHog) due to edge cases where error messages are truncated before redaction logic runs, or where request-scoped storage is omitted.