CVE-2026-10661
A vulnerability has been found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. Impacted is the function Open of the file src/blender_mcp/server.py. The manipulation of the argument input_image_url leads to injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The identifier of the patch is 5b37be25242e73dc4cf1328974d30458b9e5d67e. To fix this issue, it is recommended to deploy a patch.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.25%
- CWE
- CWE-74, CWE-707
- Published
- 2026-06-02
- Last modified
- 2026-06-03
Affected products
- ahujasid blender-mcp
Weakness type
Related vulnerabilities
- CVE-2026-87572 — Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had...
- CVE-2026-86675 — itsourcecode Sales and Inventory System us_edit.php sql injection
- CVE-2026-65669 — Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-86667 — aircheng-org iWebShop-5 member.php member_list sql injection
- CVE-2026-86518 — code-projects Student Crud Operation edit.php sql injection
- CVE-2026-86517 — itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection
- CVE-2026-86310 — itsourcecode Sales and Inventory System cust_edit1.php sql injection
- CVE-2026-86309 — itsourcecode Sales and Inventory System pro_searchfrm.php sql injection