Executive brief
A vulnerability exists in blender-mcp, a tool that allows AI assistants to interact with the Blender 3D modeling software. An attacker can trick the system into reading sensitive files from the computer running the software by providing a local file path instead of a web link for an image. This could lead to the unauthorized exposure of private data or system configuration files to external servers.
Technical details
An arbitrary file read vulnerability exists in the `generate_hunyuan3d_model` tool within `src/blender_mcp/server.py` and `addon.py`. The root cause is a lack of validation on the `input_image_url` parameter; if the string does not start with 'http', the application treats it as a local file path and uses Python's `open()` function to read it. The file contents are then base64-encoded and sent to an external API endpoint (Tencent Cloud or a local API), allowing for data exfiltration. This can be exploited remotely by an authenticated user or via indirect prompt injection against an AI assistant using the MCP server. The issue is addressed in commit 5b37be25242e73dc4cf1328974d30458b9e5d67e by implementing path validation and symlink resolution.
Affected products
- ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b
Timeline
- 2026-03-11: patched: Patch submitted via Pull Request 205
- 2026-06-02: disclosed: CVE published and NVD entry created
References
- https://github.com/ahujasid/blender-mcp/
- https://github.com/ahujasid/blender-mcp/issues/202
- https://github.com/ahujasid/blender-mcp/pull/205
- https://github.com/bergskenop/blender-mcp/commit/5b37be25242e73dc4cf1328974d30458b9e5d67e
- https://vuldb.com/cve/CVE-2026-10661
- https://vuldb.com/submit/830486
- https://vuldb.com/vuln/367956