Executive brief
BlenderMCP is a tool used to integrate Blender with AI-driven Model Context Protocol (MCP) servers. A security flaw allows an attacker to trick the software into writing malicious files to sensitive locations on a user's computer, such as startup scripts or access keys. This could lead to a full system takeover if a user is targeted via a malicious network connection or a manipulated AI prompt.
Technical details
A path traversal vulnerability exists in the `download_polyhaven_asset` method within `addon.py` of BlenderMCP. The application fetches a JSON response from the Poly Haven API and uses dictionary keys from the 'include' field directly as filesystem paths without validation. By performing a Man-in-the-Middle (MITM) attack or using prompt injection to direct the tool toward a malicious API clone, an attacker can provide paths like '../../.bashrc' to escape the intended temporary directory. This allows for arbitrary file writes with the privileges of the user running Blender, potentially leading to persistent remote code execution. The issue was fixed in commit 30a3308 by implementing path normalization and containment checks.
Affected products
- ahujasid BlenderMCP before commit 30a3308
Timeline
- 2026-05-24: disclosed: Issue reported and pull request created
- 2026-07-20: patched: Fix merged into main branch
- 2026-07-24: advisory: CVE-2026-66004 published