CVE-2026-10661
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability was found in the blender-mcp project in the Open function of server.py. Manipulating the input_image_url argument can lead to remote injection. The exploit has been publicly disclosed.
Risk Assessment
An attacker can remotely exploit this vulnerability to execute unauthorized operations on the server, potentially leading to full system compromise.
Recommendation
Apply the patch identified by 5b37be25242e73dc4cf1328974d30458b9e5d67e immediately.
Other vulnerabilities in blender-mcp
See all- CVE-2026-10688Medium
The blender-mcp plugin up to version 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b contains a code injection vulnerability in the execute_blender_code function in /src/blender_mcp/server.py. The attack can be carried out remotely and the exploit has been publicly disclosed.
- CVE-2026-10662Medium
A vulnerability was found in ahujasid blender-mcp up to 7636d13b. The function requests.get in src/blender_mcp/server.py of the ZIP File Handler component is vulnerable to server-side request forgery via the zip_file_url argument. The exploit has been made public.
Original NVD description (English source)
A vulnerability has been found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. Impacted is the function Open of the file src/blender_mcp/server.py. The manipulation of the argument input_image_url leads to injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The identifier of the patch is 5b37be25242e73dc4cf1328974d30458b9e5d67e. To fix this issue, it is recommended to deploy a patch.