Hi! Thank you for building such a powerful 2-way communication tool for Figma and Cursor.
I was extremely excited to use this and ran a security audit (bun audit / npm audit), but it flagged 3 High-severity vulnerabilities.
These are all directly coming from the outdated @modelcontextprotocol/sdk version (1.13.1) specified in the package.json.
Anthropic recently disclosed several severe vulnerabilities in the older SDK versions, including cross-client data leaks and missing DNS rebinding protection (e.g., CVE-2025-27104). They have already released the patched version out to >=1.26.0.
Since this tool handles potentially sensitive internal Figma design data over local WebSocket, these vulnerabilities are a security blocker for adoption.
Could you please bump the dependency of @modelcontextprotocol/sdk to ^1.26.0 (or latest)?
Thanks a lot for your hard work!
Hi! Thank you for building such a powerful 2-way communication tool for Figma and Cursor.
I was extremely excited to use this and ran a security audit (
bun audit/npm audit), but it flagged 3 High-severity vulnerabilities.These are all directly coming from the outdated
@modelcontextprotocol/sdkversion (1.13.1) specified in thepackage.json.Anthropic recently disclosed several severe vulnerabilities in the older SDK versions, including cross-client data leaks and missing DNS rebinding protection (e.g., CVE-2025-27104). They have already released the patched version out to
>=1.26.0.Since this tool handles potentially sensitive internal Figma design data over local WebSocket, these vulnerabilities are a security blocker for adoption.
Could you please bump the dependency of
@modelcontextprotocol/sdkto^1.26.0(orlatest)?Thanks a lot for your hard work!