CVE-2026-10688
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The blender-mcp plugin up to version 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b contains a code injection vulnerability in the execute_blender_code function in /src/blender_mcp/server.py. The attack can be carried out remotely and the exploit has been publicly disclosed.
Risk Assessment
Remote code execution could lead to full server compromise and data breach.
Recommendation
Immediately disable or secure the blender-mcp plugin until an official patch is released.
Other vulnerabilities in blender-mcp
See all- CVE-2026-10662Medium
A vulnerability was found in ahujasid blender-mcp up to 7636d13b. The function requests.get in src/blender_mcp/server.py of the ZIP File Handler component is vulnerable to server-side request forgery via the zip_file_url argument. The exploit has been made public.
- CVE-2026-10661Medium
A vulnerability was found in the blender-mcp project in the Open function of server.py. Manipulating the input_image_url argument can lead to remote injection. The exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was determined in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The impacted element is the function execute_blender_code of the file /src/blender_mcp/server.py. This manipulation of the argument code causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.