https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 19:04:23 +0000 https://db.gcve.eu/vuln/cve-2026-66004 <p><strong>Affected:</strong> ahujasid blender-mcp</p> <p>BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like &#39;../../.bashrc&#39; to overwrite sensitive files and achieve persistent code execution.</p> <p><strong>Affected:</strong> ahujasid blender-mcp</p> <p>BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious paths like &#39;../../.bashrc&#39; to overwrite sensitive files and achieve persistent code execution.</p> https://db.gcve.eu/vuln/cve-2026-66004