CVE-2026-66004: BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that all

BlenderMCP before commit 30a3308 has a path traversal vulnerability (a security flaw where attackers can access files outside intended directories) in its download_polyhaven_asset method. Attackers using MITM attacks (interception of network traffic between two parties) or prompt injection (tricking an AI by hiding instructions in its input) can inject malicious file paths like '../../.bashrc' to overwrite sensitive files and gain persistent code execution (the ability to run commands that stay active even after restarting).