{"data":{"id":"9fd3b134-dd42-41b4-afdc-30890eeebeea","title":"CVE-2026-66004: BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that…","summary":"CVE-2026-66004 affects BlenderMCP before commit 30a3308. The download_polyhaven_asset method has a path traversal flaw (CWE-22) that lets attackers write arbitrary files by injecting traversal sequences into API response include keys, such as '../../.bashrc'. Attackers performing MITM attacks or prompt injection can overwrite sensitive files and achieve persistent code execution.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-66004","publishedAt":"2026-07-24T15:19:07.050Z","cveId":"CVE-2026-66004","cweIds":["CWE-22"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["blender-mcp@< 1.6.5 (fixed: 1.6.5)"],"affectedPackageNames":["blender-mcp"],"affectedPackageRefs":["pypi:blender-mcp"],"affectedVendors":[],"affectedVendorsRaw":["BlenderMCP"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"BlenderMCP path traversal in download_polyhaven_asset method","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00296,"epssCheckedAt":"2026-11-12T15:03:08.463Z","kevDateAdded":null,"advisoryAliases":["GHSA-4h8q-hh2j-755w"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:46:13.259Z","patchAvailable":true,"disclosureDate":"2026-07-24T15:19:07.050Z","fixReleasedAt":"2026-07-29T11:04:57.701Z","daysToFix":5,"fixCheckedAt":"2026-10-29T21:32:41.753Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"pypi","name":"blender-mcp","fixedVersion":"1.6.5","matchedVersion":"1.6.5","fixReleasedAt":"2026-07-29T11:04:57.701Z","daysToFix":5,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:32:41.606Z"}]}}