PyPI/blender-mcp CVE-2026-66004: medium 5.3, EPSS 0.30%
BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes
Action: Upgrade blender-mcp to 1.6.5 or later.
pip install blender-mcp==1.6.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.6.5 | - |
Fixed versions
| 1.6.5 |
Sources
- osv: GHSA-4h8q-hh2j-755w
- https://nvd.nist.gov/vuln/detail/CVE-2026-66004
- https://github.com/ahujasid/blender-mcp/issues/257
- https://github.com/ahujasid/blender-mcp/pull/258
- https://github.com/ahujasid/blender-mcp/commit/30a3308446cd8f81a9446e5a2ed657c0d8d86072
- https://github.com/ahujasid/mcp-for-blender
- https://www.vulncheck.com/advisories/blendermcp-path-traversal-via-download-polyhaven-asset-api
CVE-2026-66004 · published · modified · JSON