CVE-2026-10688
Description
A vulnerability was determined in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The impacted element is the function execute_blender_code of the file /src/blender_mcp/server.py. This manipulation of the argument code causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
1- Range: up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The `execute_blender_code` function passes user-controlled input directly to Python's `exec()` function without sanitization."
Attack vector
An attacker can remotely trigger this vulnerability by sending a specially crafted command to the Blender MCP server. The server forwards this command, which contains arbitrary Python code, to the Blender addon. The addon then executes this code using `exec()`, allowing the attacker to run commands with the privileges of the Blender process [ref_id=2]. This can be achieved through methods like indirect prompt injection [ref_id=2].
Affected code
The vulnerability resides in the `execute_blender_code` function within the file `/src/blender_mcp/server.py`. This function forwards the `code` parameter to the Blender addon's `execute_code` method, which then passes it to the `exec()` function in `/addon.py` [ref_id=2].
What the fix does
The advisory does not specify a patch or provide remediation guidance. The project was informed of the problem but has not responded. Therefore, no fix is currently available.
Preconditions
- networkThe attacker must be able to reach the Blender MCP server over the network.
- inputThe attacker must be able to control the `code` parameter sent to the `execute_blender_code` function.
Reproduction
npx @modelcontextprotocol/inspector -- uv run blender-mcp
Click Connect Go to the Tools tab and click List Tools Select the execute_blender_code tool Verify the file /tmp/TEST does not exist: It shows: No such file or directory Back to the Inspector, in the code parameter, enter: import os; os.system('id > /tmp/TEST') and click Run Tool. Observe the request being sent: { "method": "tools/call", "params": { "name": "execute_blender_code", "arguments": { "code": "import os; os.system('id >> /tmp/TEST')" }, "_meta": { "progressToken": 1 } } } Response: { "content": [ { "type": "text", "text": "Code executed successfully: " } ], "isError": false } Confirm that the injected command executed:
Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5News mentions
0No linked articles in our index yet.