Is CVE-2026-66004 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66004 being exploited in the wild.

How severe is CVE-2026-66004?

Medium severity, with a CVSS score of 5.3, published 24 July 2026.

Which products and versions are affected?

Ahujasid BlenderMCP before commit 30a3308; blender-mcp (PyPI) < 1.6.5, ECOSYSTEM:introduced=0,fixed=1.6.5.

Is there a fix for CVE-2026-66004?

Yes. blender-mcp (PyPI): upgrade to 1.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66004 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-66004?

Check whether you run Ahujasid BlenderMCP or blender-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66004: ahujasid BlenderMCP path traversal in download_polyhaven_asset

Q: Is there a fix for CVE-2026-66004?

Yes. blender-mcp (PyPI): upgrade to 1.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-66004 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-66004?

Check whether you run Ahujasid BlenderMCP or blender-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66004 · Severity: medium · CVSS 5.3 · Published 2026-07-24

BlenderMCP is a tool used to integrate Blender with AI-driven Model Context Protocol (MCP) servers. A security flaw allows an attacker to trick the software into writing malicious files to sensitive locations on a user's computer, such as startup scripts or access keys. This could lead to a full system takeover if a user is targeted via a malicious network connection or a manipulated AI prompt.

Vendors: Ahujasid, PyPI.

Quick answers

Is CVE-2026-66004 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66004 being exploited in the wild.
How severe is CVE-2026-66004?: Medium severity, with a CVSS score of 5.3, published 24 July 2026.
Which products and versions are affected?: Ahujasid BlenderMCP before commit 30a3308; blender-mcp (PyPI) < 1.6.5, ECOSYSTEM:introduced=0,fixed=1.6.5.
Is there a fix for CVE-2026-66004?: Yes. blender-mcp (PyPI): upgrade to 1.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66004 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-66004?: Check whether you run Ahujasid BlenderMCP or blender-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

blender-mcp (PyPI): upgrade to 1.6.5 or later
```
pip install "blender-mcp>=1.6.5"
```

Technical details

A path traversal vulnerability exists in the `download_polyhaven_asset` method within `addon.py` of BlenderMCP. The application fetches a JSON response from the Poly Haven API and uses dictionary keys from the 'include' field directly as filesystem paths without validation. By performing a Man-in-the-Middle (MITM) attack or using prompt injection to direct the tool toward a malicious API clone, an attacker can provide paths like '../../.bashrc' to escape the intended temporary directory. This allows for arbitrary file writes with the privileges of the user running Blender, potentially leading to persistent remote code execution. The issue was fixed in commit 30a3308 by implementing path normalization and containment checks.

Affected products

ahujasid BlenderMCP before commit 30a3308

Identifiers

CVE-2026-66004
GHSA-4h8q-hh2j-755w
PYSEC-2026-4203

Timeline

2026-05-24: disclosed: Issue reported and pull request created
2026-07-20: patched: Fix merged into main branch
2026-07-24: advisory: CVE-2026-66004 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.