CVE-2026-66004: BlenderMCP: path traversal enables arbitrary file write

Q: Is CVE-2026-66004 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-66004, increasing the risk of exploitation.

Q: How to fix CVE-2026-66004?

1) Upgrade blender-mcp (pip) to 1.6.5 or later, which includes commit 30a3308. 2) Until patched, disable or avoid the Polyhaven download tool and restrict the MCP server to trusted networks with TLS verification intact. 3) Run MCP servers under a low-privilege account or sandbox/container so that writes cannot reach shell profiles or SSH keys. 4) Require human approval for MCP tool calls that download or write files. 5) Detect by monitoring for unexpected modifications to ~/.bashrc, ~/.zshrc, ~/.ssh/authorized_keys, LaunchAgents and cron entries on hosts running blender-mcp, and by inspecting outbound traffic to Polyhaven for anomalies. 6) Inventory MCP servers across developer endpoints and track them as software supply chain components.

Q: What systems are affected by CVE-2026-66004?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, AI-assisted creative tooling, developer workstations with LLM tool integrations.

Q: What is the CVSS score for CVE-2026-66004?

CVE-2026-66004 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.30%.

GHSA-4h8q-hh2j-755wMEDIUMPoC AVAILABLE

Published July 24, 2026

CISO Take

BlenderMCP, an MCP server that lets AI assistants drive Blender, fails to sanitize file paths returned by the Polyhaven asset API, so a malicious or tampered response can write files anywhere the user can write, for example overwriting ~/.bashrc to gain persistent code execution. Severity is medium (CVSS 5.3) because exploitation requires a man-in-the-middle position or a successful prompt injection and the user must interact, and EPSS is low at 0.003 (roughly the 80th percentile), with no KEV listing. A public PoC exists, however, and the prompt-injection route makes the attack realistic for developers and creative teams who run AI agents on workstations with sensitive credentials. Upgrade blender-mcp to 1.6.5 or later, and treat any AI agent tool that fetches remote assets as untrusted input handling.

Sources:NVDEPSSGitHub AdvisoryATLASvulncheck.com

What is the risk?

Overall risk is medium and mainly concerns developer and designer endpoints. Exploitability is limited by high attack complexity (MITM or prompt injection required) and user interaction. Integrity impact is high because arbitrary file overwrite of shell startup files or config converts into persistent code execution under the user's privileges. Confidentiality and availability impact are not rated. A public PoC exists, but EPSS is low (0.00296) and there is no evidence of active exploitation. Exposure is limited to hosts running vulnerable blender-mcp versions below 1.6.5 with the Polyhaven integration enabled.

How does the attack unfold?

Initial Access

Attacker positions as a MITM or injects a prompt that causes BlenderMCP to fetch a crafted Polyhaven API response.

AML.T0051.001

Exploitation

The download_polyhaven_asset method uses traversal sequences in include keys such as '../../.bashrc' to write outside the intended directory.

AML.T0053

Persistence

The overwritten shell profile or startup file runs attacker commands on the next login or terminal launch.

AML.T0081

Impact

Persistent code execution on the workstation exposes credentials, source code and connected systems.

AML.T0112.000

Initial Access

Attacker positions as a MITM or injects a prompt that causes BlenderMCP to fetch a crafted Polyhaven API response.

AML.T0051.001

Exploitation

The download_polyhaven_asset method uses traversal sequences in include keys such as '../../.bashrc' to write outside the intended directory.

AML.T0053

Persistence

The overwritten shell profile or startup file runs attacker commands on the next login or terminal launch.

AML.T0081

Impact

Persistent code execution on the workstation exposes credentials, source code and connected systems.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
blender-mcp	pip	< 1.6.5	`1.6.5`

Do you use blender-mcp? You're affected.

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRNone

UIRequired

SUnchanged

CNone

IHigh

ANone

What should I do?

1 step

1) Upgrade blender-mcp (pip) to 1.6.5 or later, which includes commit 30a3308. 2) Until patched, disable or avoid the Polyhaven download tool and restrict the MCP server to trusted networks with TLS verification intact. 3) Run MCP servers under a low-privilege account or sandbox/container so that writes cannot reach shell profiles or SSH keys. 4) Require human approval for MCP tool calls that download or write files. 5) Detect by monitoring for unexpected modifications to ~/.bashrc, ~/.zshrc, ~/.ssh/authorized_keys, LaunchAgents and cron entries on hosts running blender-mcp, and by inspecting outbound traffic to Polyhaven for anomalies. 6) Inventory MCP servers across developer endpoints and track them as software supply chain components.

How is it classified?

Code ExecutionPrompt InjectionSupply ChainAgentPluginAPIAML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0081- Modify AI Agent Configuration AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM01-Prompt InjectionLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-66004?

Is CVE-2026-66004 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-66004, increasing the risk of exploitation.

How to fix CVE-2026-66004?

1) Upgrade blender-mcp (pip) to 1.6.5 or later, which includes commit 30a3308. 2) Until patched, disable or avoid the Polyhaven download tool and restrict the MCP server to trusted networks with TLS verification intact. 3) Run MCP servers under a low-privilege account or sandbox/container so that writes cannot reach shell profiles or SSH keys. 4) Require human approval for MCP tool calls that download or write files. 5) Detect by monitoring for unexpected modifications to ~/.bashrc, ~/.zshrc, ~/.ssh/authorized_keys, LaunchAgents and cron entries on hosts running blender-mcp, and by inspecting outbound traffic to Polyhaven for anomalies. 6) Inventory MCP servers across developer endpoints and track them as software supply chain components.

What systems are affected by CVE-2026-66004?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, AI-assisted creative tooling, developer workstations with LLM tool integrations.

What is the CVSS score for CVE-2026-66004?

CVE-2026-66004 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serversAI-assisted creative toolingdeveloper workstations with LLM tool integrations

MITRE ATLAS Techniques

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0081Modify AI Agent Configuration

AML.T0112.000Local AI Agent

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM01, LLM06

What are the technical details?

Original Advisory

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.

Exploitation Scenario

An attacker plants hidden instructions in a webpage or document that a developer's AI assistant processes, steering it to request a specific Polyhaven asset download through BlenderMCP. Alternatively, the attacker sits on the same untrusted network and tampers with the Polyhaven API response. The crafted response lists an include key such as '../../.bashrc' with attacker-controlled content, and the server writes it outside the download directory. The next time the user opens a terminal, the injected commands run, giving the attacker persistent code execution and access to credentials and source code on the workstation.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.