CVE-2026-66004: BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes

When it downloads a Poly Haven asset, download_polyhaven_asset takes the keys of the API's "include" dictionary and uses them as relative file paths under a temporary directory. Before the fix, nothing checked those keys. A key such as ../../.bashrc made the server write the downloaded content outside the temp directory, overwriting a file in the user's home.

The attacker must control the API response or the tool's input. The advisory names two ways: a man-in-the-middle on the connection to Poly Haven, or prompt injection that steers the agent into fetching a malicious asset. Both need the user to run the tool, which is why the CVSS vector has user interaction and high attack complexity.

Overwriting a shell startup file such as .bashrc runs the attacker's commands the next time a shell starts, giving persistent code execution as the user who runs Blender and the MCP server. Other targets include SSH authorized_keys or any file that user can write. The score is 5.3 under CVSS 3.1 with high integrity impact only.

The blender-mcp pip package before 1.6.5. The vulnerable code is in every build before commit 30a3308, which was merged on July 20, 2026. Only setups that use the Poly Haven download tool are exposed, but the tool is part of the default server.

pip show blender-mcp

If you run it with uvx, check which version your MCP client config resolves.

Upgrade to blender-mcp 1.6.5.

pip install --upgrade blender-mcp==1.6.5

The fix, pull request 258, checks each include key before joining it to the temp directory. It normalizes the path, rejects absolute paths and paths containing .., and requires the resolved path to stay inside the temp directory. An unsafe include is logged and skipped, and valid models still import. The sources list no workaround. Until you upgrade, disable the Poly Haven integration and do not let the agent act on untrusted content.

Look for files changed outside the temp download directory around the time of a Poly Haven download: .bashrc, .zshrc, .profile, ~/.ssh/authorized_keys and other startup files. Check shell history and new processes for commands you did not run. After the fix, skipped entries appear in the server log as unsafe includes. Beam records agent file access and shell commands, so its logs can show a write outside the project by an agent session.

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like '../../.bashrc' to overwrite sensitive files and achieve persistent code execution.