Nuevo chat
Ctrl
K
Complementos Tareas programadas
Kimi Work Kimi Code
  • Obtener aplicación
  • Acerca de nosotros
  • Idioma
  • Ayuda y soporte

Blender MCP 投毒与检查

如何检查本地电脑是否受 CVE-2026-66004 的影响
告知插件服务器失败并重连授权请求
The user asks: "如何检查本地电脑是否受 CVE-2026-66004 的影响" (How to check if my local computer is affected by CVE-2026-66004).
CVE-2026-66004 is the blender-mcp download_polyhaven_asset path traversal vulnerability via Poly Haven API response. Based on my earlier search results:
  • The vulnerability is in ahujasid/blender-mcp's addon or server code — download_polyhaven_asset trusting the include field keys from Poly Haven API responses as file paths without validation.
  • MITM or a forged/malicious Poly Haven API response could inject traversal paths like ../../.bashrc, achieving arbitrary file write → persistence.
I need to verify details: which component is affected (the Blender addon vs the MCP server?), which versions, whether there's a fixed version, and what the remediation is. Let me search for the CVE details first to make sure I give accurate guidance.
Let me search for CVE-2026-66004 specifics: affected versions, fix commit, affected file paths.
Note: the GitHub plugin MCP server failed this turn, so I can't use GitHub tools. I should mention that briefly per plugin_status instructions ("Tell the user which plugin servers failed and ask them to retry, reconnect, or re-authorize") — but only if relevant. The GitHub plugin would have been useful to check the repo. I can mention it briefly. Actually the instruction says to tell the user which plugin servers failed and ask them to retry/reconnect/re-authorize. I'll mention it briefly at the end or when relevant — since I might have wanted to look up the repo's fix commit. But web search can suffice. I'll add a one-line note.
Let me search for the CVE details.
我先核实一下这个 CVE 的具体受影响版本和修复情况，再给你检查步骤。
Buscar en la Web
CVE-2026-66004 blender-mcp download_polyhaven_asset affected version fix ahujasid blender-mcp issue 257 polyhaven path traversal 修复 版本 CVE-2026-66004 受影响版本 修复
28 resultados
写入风险与PolyHaven
I now have solid details:
  • CVE-2026-66004: BlenderMCP (ahujasid/blender-mcp) path traversal in download_polyhaven_asset, trusting include keys from Poly Haven API response without validation.
  • Affected: all versions before commit 30a3308446cd8f81a9446e5a2ed657c0d8d86072 (merged via PR #258).
  • Exploitation vectors: MITM on Poly Haven API, or prompt injection causing the AI to trigger downloads with malicious paths.
  • IoCs: unexpected modifications to ~/.bashrc, ~/.zshrc, ~/.profile, ~/.ssh/authorized_keys; file writes by the BlenderMCP python process outside temp dir; outbound HTTP to non-official Poly Haven endpoints; patched version logs "Skipping include with unsafe path:".
  • The package is on PyPI (pkg:pypi/blender-mcp), rolling release.
  • Disclosed 2026-05-24, CVE published 2026-07-24.
The user is on macOS (from memory: macOS 工具开发, Mac user). So I should tailor checks for macOS primarily, with Linux notes too. Actually the memory says they develop macOS tools and use macOS — so give macOS-flavored commands (zsh, launchd, ~/Library paths), with Linux equivalents noted.
How to check if local computer is affected:
Step 1: Determine if blender-mcp is even installed
  • Check MCP client configs (Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json on macOS; Cursor: ~/.cursor/mcp.json; VS Code: .vscode/mcp.json or user settings) for "blender" entries — typically invoked via uvx blender-mcp.
  • Check pip: pip list | grep -i blender / pipx list / uv tool list.
  • Check uv cache: uvx runs ephemeral envs from cache — check ~/.cache/uv for blender-mcp versions.
  • Check if Blender addon installed: Blender addon.py from the repo — the vulnerable code is in server.py? Let me recall: download_polyhaven_asset — in the blender-mcp repo, the Poly Haven download logic is in src/blender_mcp/server.py (the MCP server side, which talks to the addon over socket). Actually from issue #257 earlier: "arbitrary file write via polyhaven include_path traversal". The CVE data says fix commit 30a3308 in the repo; the PyPI package blender-mcp is affected. The check for fixed code: look for "Skipping include with unsafe path" log message string in server.py.
Step 2: Check version/commit
  • If installed from git: git log --oneline | grep 30a3308 or check merge-base.
  • If installed from PyPI: pip show blender-mcp, check version; inspect installed server.py for the validation code (e.g., grep for "Skipping include with unsafe path" or path validation using resolve/relative_to temp_dir).
  • If run via uvx: uv tool list / find in ~/.cache/uv/archive-v0/ — grep the cached server.py.
Step 3: Look for signs of exploitation (IoC)
  • Check shell startup files for unexpected modifications: ~/.zshrc, ~/.bashrc, ~/.bash_profile, ~/.profile — check mtimes: ls -lT ~/.zshrc (macOS), stat on Linux. Compare against expected.
  • Check ~/.ssh/authorized_keys for unknown keys; check mtime.
  • macOS persistence: ~/Library/LaunchAgents new plist; cron (crontab -l).
  • Check Blender's temp dir usage: blender-mcp downloads to temp dir; look for stray files that escaped.
  • Check network: connections to polyhaven.com API should be HTTPS to api.polyhaven.com; MITM scenario — check for unusual proxy/VPN configs (user is privacy-sensitive, uses VPN — hmm, interesting: MITM vector could come from a malicious VPN/proxy; memory says they ditched a commercial VPN that auto-reinstalled itself).
  • Logs: MCP client logs (Claude Desktop logs in ~/Library/Logs/Claude/mcp*.log) — grep for polyhaven download invocations; patched versions log "Skipping include with unsafe path:".
  • Check for unexpected files in home dir with recent mtimes around when blender-mcp was used.
Step 4: Remediate
  • Upgrade to latest (commit ≥ 30a3308; pip install -U blender-mcp; or if uvx pinned, refresh cache: uvx --refresh blender-mcp or uv cache clean).
  • Note: even patched, blender-mcp has other open issues (CVE-2026-10688 execute_blender_code unpatched — project slow to respond), so consider sandboxing or disabling polyhaven tool.
  • Workarounds: disable download_polyhaven_asset exposure; run in container with read-only home; pin HTTPS with cert validation.
Also: check the Blender addon side (addon.py inside Blender) — the addon executes code from server; the traversal is server-side though (server.py downloads files). The CVE references server-side download_polyhaven_asset. The addon also has download logic? In blender-mcp, download_polyhaven_asset is implemented in server.py which fetches from Poly Haven API and writes files. So checking server.py is key.
The user's machine is macOS. Give macOS commands primarily, mention Linux variants.
Format: step-by-step, code blocks, concise. Use [^N^] citations for the facts from search (fix commit, IoCs, log message). Keep it practical.
Should I mention GitHub plugin failure? The plugin_status meta says: "Tell the user which plugin servers failed and ask them to retry, reconnect, or re-authorize." — This is awareness=high, so it's an active directive. I should mention briefly that the GitHub plugin couldn't connect this turn, so I couldn't pull the repo directly via GitHub tools — but it doesn't really matter for this answer. A one-liner note at the end suffices, in Chinese, natural.
Let me structure:
  1. 先确认是否装了 blender-mcp（检查 MCP 客户端配置 + pip/uvx）
  2. 确认版本是否含修复提交 30a3308（PyPI 包是滚动发布，直接检查代码里有没有校验逻辑——grep "Skipping include with unsafe path"）
  3. 排查是否已被利用（IoC 清单：shell 启动文件、authorized_keys、LaunchAgents、进程/网络）
  4. 处置建议（升级/清 uvx 缓存/沙箱/停用 polyhaven 工具）
  5. GitHub 插件连接失败提示一句
Commands for macOS (zsh). Keep them copy-pasteable.
Check uv cache path: uv stores cached wheels under ~/.cache/uv. For uvx blender-mcp, the ephemeral environment is built from cache. uv cache clean blender-mcp clears specific package. uvx --refresh-package blender-mcp blender-mcp? Actually uvx --refresh blender-mcp refreshes all. There's uvx --refresh-package <pkg> <tool>. I'll keep it simple: uv cache clean blender-mcp.
Claude Desktop config path macOS: ~/Library/Application Support/Claude/claude_desktop_config.json. Cursor: ~/.cursor/mcp.json.
For finding stray writes: find ~ -mtime -N type checks are noisy; better to anchor on specific IoC files.
Also note EPSS <1%, not in CISA KEV, exploitation requires MITM or prompt injection + user triggering polyhaven download — so risk depends on whether they ever used the Poly Haven download feature. That's an important scoping point: 如果没用过「从 Poly Haven 下载素材」功能，基本没有被这个 CVE 直接打到的路径（除非 prompt injection 诱导调用）。
Length: medium — practical checklist with commands. Chinese, full-width punctuation.
先给个前提：CVE-2026-66004 影响的是 ahujasid/blender-mcp 在修复提交 30a3308 之前的所有版本（PyPI 包滚动发布，没有语义化版本号，所以要按代码内容判断）[^^74^^][^^72^^]。利用条件是：MCP 服务器调用过 download_polyhaven_asset，且 Poly Haven API 响应被 MITM 篡改或经提示注入诱导，才能把 ../../.bashrc 这类穿越路径写成任意文件 [^^74^^]。按下面四步走：
第 1 步：确认本机是否装了 blender-mcp
先查 MCP 客户端配置里有没有挂这个 server：
bash
Copiar
# Claude Desktop（macOS）
grep -i blender "$HOME/Library/Application Support/Claude/claude_desktop_config.json"
# Cursor
grep -i blender "$HOME/.cursor/mcp.json"
# 常见安装方式逐一查
pip list 2>/dev/null | grep -i blender
uv tool list 2>/dev/null | grep -i blender
pipx list 2>/dev/null | grep -i blender
如果这些都没有命中，本机不受此 CVE 影响，到此为止。配置里常见的写法是 uvx blender-mcp，uvx 的包落在缓存里：
bash
Copiar
find ~/.cache/uv -name "server.py" -path "*blender_mcp*" 2>/dev/null
第 2 步：判断版本是否带修复
修复补丁会对 include_path 做归一化、拒绝绝对路径和 .. 段、并校验解析后的路径不逃出 temp_dir；补丁版日志里会出现 Skipping include with unsafe path: [^^70^^]。直接对装好的代码做内容检查（比版本号可靠）：
bash
Copiar
# 把路径换成第 1 步找到的实际位置；pip 安装的用 python -c "import blender_mcp, os; print(os.path.dirname(blender_mcp.__file__))"
grep -rn "Skipping include with unsafe path" <blender_mcp安装目录>/server.py
  • grep 有输出 → 已含修复，不受影响。
  • grep 无输出 → 是受影响版本，继续第 3 步排查痕迹，然后升级。
如果是 git clone 装的，也可以 git log --oneline | grep 30a3308 或 git merge-base --is-ancestor 30a3308446cd8f81a9446e5a2ed657c0d8d86072 HEAD && echo FIXED || echo VULNERABLE [^^70^^]。
第 3 步：排查是否已被利用（IoC 检查）
这个漏洞的最终动作是越目录写文件，典型目标是持久化文件 [^^70^^]。重点查：
bash
Copiar
# 1. shell 启动文件是否被异常改动（看修改时间是否与你印象中一致）
ls -lT ~/.zshrc ~/.bashrc ~/.bash_profile ~/.profile 2>/dev/null

# 2. SSH authorized_keys 有无陌生公钥、修改时间是否异常
ls -lT ~/.ssh/authorized_keys && cat ~/.ssh/authorized_keys

# 3. macOS 持久化项：LaunchAgents 里有无近期新增的可疑 plist
ls -lT ~/Library/LaunchAgents/

# 4. crontab
crontab -l
再补两个交叉验证：
  • 翻 MCP 客户端日志（Claude Desktop 在 ~/Library/Logs/Claude/），搜 download_polyhaven_asset / polyhaven 的调用记录——如果你从没让 AI 从 Poly Haven 下载过素材，这个 CVE 基本没有触发路径；
  • 检查网络层面是否有过非官方的 Poly Haven 端点连接（官方是 api.polyhaven.com 的 HTTPS），尤其是用过不可信代理/VPN 的时段 [^^70^^]。
另外可以全目录扫一遍近期被 Python 进程写入的家目录异常文件：
bash
Copiar
find ~ -maxdepth 2 -mtime -90 -type f \( -name "*.sh" -o -name "*.plist" -o -name "authorized_keys" \) 2>/dev/null | grep -v Library
第 4 步：处置
  • 升级：pip install -U blender-mcp；uvx 方式要先清缓存再跑，否则会继续用旧缓存：uv cache clean blender-mcp，然后重复第 2 步验证补丁字符串存在 [^^70^^]。
  • 升级前若 IoC 有异常（启动文件多出陌生命令、authorized_keys 多出陌生公钥），先清理/替换这些文件并视情况轮换凭据。
  • 缓解项：在 MCP 配置里不暴露 download_polyhaven_asset 工具，或把 blender-mcp 跑在容器/沙箱里（家目录只读）[^^70^^]。
补一句背景供你权衡：这个项目整体维护响应偏慢——同期的 execute_blender_code 任意代码执行漏洞（CVE-2026-10688）至今没有修复版本 [^^26^^]，就算补上 66004，长期挂在日常环境里建议保持沙箱隔离。
最后说明一下：本轮 GitHub 插件连接失败，我没法直接用它拉取仓库验证补丁细节（上面的检查命令不依赖它）。如果你需要我直接查仓库代码或 issue #257 的原文，重连/重新授权一下 GitHub 插件再说一声即可。