blender-mcp vulnerabilities

The blender-mcp plugin up to version 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b contains a code injection vulnerability in the execute_blender_code function in /src/blender_mcp/server.py. The attack can be carried out remotely and the exploit has been publicly disclosed.

A vulnerability was found in ahujasid blender-mcp up to 7636d13b. The function requests.get in src/blender_mcp/server.py of the ZIP File Handler component is vulnerable to server-side request forgery via the zip_file_url argument. The exploit has been made public.

A vulnerability was found in the blender-mcp project in the Open function of server.py. Manipulating the input_image_url argument can lead to remote injection. The exploit has been publicly disclosed.