CVE-2026-10688: Code Injection in ahujasid blender-mcp

Technical summary

CVE-2026-10688 is a remote code injection vulnerability in blender-mcp's /src/blender_mcp/server.py, specifically in the execute_blender_code function. The vulnerability stems from improper validation of the 'code' argument, allowing attackers to inject malicious code that executes in the server process. The CWE classifications (CWE-74: Improper Neutralization of Special Elements in Output, CWE-94: Improper Control of Generation of Code) indicate the root cause is insufficient input sanitization before code evaluation. While the CVSS 3.1 score of 5.5 (MEDIUM) reflects that authentication is required and privilege is limited, the practical impact is significant because an authenticated user—potentially an insider or someone with legitimate system access—can achieve arbitrary code execution.

Business impact

An authenticated user exploiting this vulnerability could execute arbitrary code on a system running blender-mcp, potentially leading to data theft, system compromise, lateral movement within a network, or disruption of Blender-based workflows. Organizations using blender-mcp for automation, rendering pipelines, or collaborative projects should treat this as a priority because the barrier to exploitation is low once an attacker is authenticated. The lack of vendor response increases operational risk for teams dependent on this tool.

Affected systems

ahujasid blender-mcp up to commit 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b is affected. Because the project uses a rolling release strategy, traditional version numbers are not available. Teams must track the repository history to determine whether their deployed instance includes the vulnerable code. Any deployment prior to the commit that fixes the execute_blender_code function validation is at risk.

Exploitability

The vulnerability is exploitable remotely over the network by any authenticated user. Public disclosure and availability of exploit code lower the barrier to abuse. The attack requires authentication but no special privileges, and user interaction is part of the attack vector (CVSS metric UI:R). This combination means an insider threat or compromised user account could weaponize this flaw with minimal complexity. The simplicity of code injection attacks once a foothold exists makes early detection and remediation critical.

Remediation

Immediate actions: (1) Review access controls for blender-mcp systems—limit authentication to trusted users and networks only. (2) Monitor the project's repository and issue tracker for patches or workarounds; since the maintainers have been notified but not yet responded, community-driven fixes or forks may emerge. (3) Consider isolating blender-mcp instances in sandboxed or containerized environments with restricted capabilities to limit blast radius if exploited. (4) Evaluate alternative tools or temporary operational constraints until a fix is available. Teams should avoid upgrading to the latest rolling release blindly without verification that the vulnerability has been patched.

Patch guidance

The vendor has not issued an official patch as of the modification date. Because blender-mcp uses rolling releases, verify against the project's repository and issue tracker to confirm whether the vulnerable code has been removed or hardened. Check the commit history after 2026-06-17 for validation of the execute_blender_code function and input sanitization improvements. Until a confirmed fix is released, treat all deployments running code prior to a verified security commit as vulnerable.

Detection guidance

Monitor network traffic to blender-mcp instances for unusual execute_blender_code requests or abnormal code payloads in the 'code' parameter. Log and alert on any authenticated session that submits code containing suspicious constructs (e.g., import statements for system libraries, os module calls, or subprocess invocations). Endpoint detection should flag unexpected child processes spawned by blender-mcp server processes. Review authentication logs for unusual or privileged account activity immediately before exploitation attempts.

Why prioritize this

Although assigned CVSS 5.5 (MEDIUM), this vulnerability merits high-priority attention due to: (1) public exploit availability reducing time to weaponization, (2) remote exploitability over authenticated channels, (3) arbitrary code execution capability with full server process privileges, (4) lack of vendor response indicating no official timeline for remediation, and (5) rolling release model creating uncertainty about patch status. Teams using blender-mcp for production workflows should treat this as a high-priority operational risk requiring immediate protective measures.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a MEDIUM severity: remote, unauthenticated barrier (AV:N, AC:L), but requires a logged-in user (PR:L) and user interaction (UI:R). Confidentiality, integrity, and availability impacts are each marked as Low (L). However, the real-world risk is elevated by public exploit availability, the criticality of code execution for system compromise, and the lack of vendor remediation progress. Organizations should treat this as functionally higher-priority than the numeric score suggests.

Frequently asked questions