Executive brief
A security vulnerability exists in blender-mcp, a tool that allows AI assistants to interact with the Blender 3D modeling application. An attacker can send malicious commands that the software will execute as system-level code. This could allow an unauthorized user to take control of the computer running Blender, potentially leading to the theft of files, data loss, or further network compromise.
Technical details
A code injection vulnerability exists in blender-mcp up to commit 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The root cause is the use of Python's exec() function within the execute_blender_code function in /src/blender_mcp/server.py, which processes user-controlled input without sanitization or sandboxing. An attacker can exploit this by providing a malicious 'code' argument via the MCP client, which is then forwarded to the Blender addon and executed with the privileges of the Blender process. This allows for arbitrary system command execution through modules like 'os' or 'subprocess'. While the attack is network-reachable, it may require low-level authentication or user interaction via indirect prompt injection. No official patch has been confirmed by the vendor.
Affected products
- ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b
Timeline
- 2026-03-10: disclosed: Issue reported on GitHub repository
- 2026-06-02: advisory: CVE published by VulDB/NVD