MediumVulnerability
CVE-2026-66004: BlenderMCP path traversal in download_polyhaven_asset method
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-66004
- Published
- Record updated
- Affected
- blender-mcp < 1.6.5
- Fixed in
- 1.6.5
- released July 29, 2026, 5 days after disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
CVE-2026-66004 affects BlenderMCP before commit 30a3308. The download_polyhaven_asset method has a path traversal flaw (CWE-22) that lets attackers write arbitrary files by injecting traversal sequences into API response include keys, such as '../../.bashrc'. Attackers performing MITM attacks or prompt injection can overwrite sensitive files and achieve persistent code execution.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database
- MediumAI found Linux kernel bugs that remained undetected for decadesSimilar attack · CSO Online
- InfoInside an AI Attack Against a US RetailerSimilar attack · Dark Reading
- HighCVE-2026-67547: taOS remote code execution via skill-exec endpoint for non-admin usersSimilar attack · NVD/CVE Database
- MediumCVE-2026-65957: Helio dashboard CORS origin validation bypass via private-network prefix matchSimilar attack · NVD/CVE Database