CVE-2026-66004

Name of the Vulnerable Software and Affected Versions BlenderMCP versions prior to commit 30a3308

Description A path traversal issue exists in the download polyhaven asset() function. This flaw allows attackers to write arbitrary files by injecting traversal sequences into API response include keys. By utilizing Man-in-the-Middle (MITM) attacks or prompt injection, an attacker can provide malicious paths, such as ../../.bashrc, to overwrite sensitive files and achieve persistent code execution.

Recommendations Update BlenderMCP to commit 30a3308 or a later version. As a temporary mitigation, restrict the use of the download polyhaven asset() function.