PT-2026-45876 · Unknown · Blender-Mcp

Skywings · CVE-2026-10688 · Published 2026-06-02 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ahujasid blender-mcp versions prior to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b

Description Remote code injection is possible through the manipulation of the code argument within the execute blender code() function located in the /src/blender mcp/server.py file.

Recommendations Update to a version later than 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. As a temporary workaround, restrict access to the execute blender code() function to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Special Elements Injection

Weakness Enumeration

CWE-94

CWE-74

Related Identifiers

CVE-2026-10688

Affected Products

Blender-Mcp

References · 10

• 🔥 https://github.com/ahujasid/blender-mcp/issues/201 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-10688 · Security Note
• https://vuldb.com/submit/830728 · Note
• https://vuldb.com/vuln/367958 · Note
• https://t.me/cveNotify/165995 · Telegram Post
• https://vuldb.com/cve/CVE-2026-10688 · Note
• https://t.me/CVEtracker/55670 · Telegram Post
• https://vuldb.com/vuln/367958/cti · Note
• https://github.com/ahujasid/blender-mcp · Note
• https://twitter.com/CVEnew/status/2061993200005378328 · Twitter Post