Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

blender-mcp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.0PyPIAmendedPublished

    BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes

    CVE-2026-66004 · GHSA-4h8q-hh2j-755w

    Affected
    • PyPI blender-mcp < 1.6.5
    Fixed in
    1.6.5· Vendor fix available
    Issue
    BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.

    Recommended action: Upgrade to 1.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →