HIGH

CVE-2025-56803

CVSS v3

8.4

HIGH

EPSS Score

1.1 %

exploit probability, as of 2026-09-25

CISA KEV

known exploited

Exploitation

—

SSVC status

Description

Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to child_process.exec without validation, leading to possible RCE. NOTE: this is disputed by the Supplier because the behavior only allows a local user to attack himself via a local plugin. The local build procedure, which is essential to the attack, is not executed for plugins shared to the Figma Community.

Technical details

Published: 2025-09-03

Frequently asked questions

What is CVE-2025-56803?

Is CVE-2025-56803 actively exploited?

Active exploitation of CVE-2025-56803 has not been confirmed. Its EPSS score was 1.1% on 2026-09-25, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-56803?

CVE-2025-56803 has a CVSS v3 base score of 8.4 (HIGH severity).

Is CVE-2025-56803 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IP Search CVEs SIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2025 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database