CVE-2026-10688Active Exploitation

MEDIUMCVSS 2.0 · LOW

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability was determined in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The impacted element is the function execute_blender_code of the file /src/blender_mcp/server.py. This manipulation of the argument code causes code injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-74CWE-94

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Active Exploitation

150.0%

Disclosure

150.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-10688

Full discourse2 posts

NerdieNews@NewsNerdie136d
Active Exploitation
⚠️ Exploit alert: Attackers are actively targeting ahujasid blender-mcp CVE-2026-10688 to inject code via execute_blender_code, potentially compromising systems globally. Patch now to block this threat. #NerdieNews #CyberSecurity #Vulnerability https://t.co/eousza1Sai
Post summary
The tweet warns that attackers are actively exploiting CVE‑2026‑10688 in blender‑mcp to inject code via execute_blender_code, urging immediate patching to mitigate a global threat.
0000049
65 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-10688 A vulnerability was determined in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The impacted element is the function execute_blender_code of th… https://www.cve.org/CVERecord?id=CVE-2026-10688
Post summary
A newly identified CVE (CVE-2026-10688) affects the execute_blender_code function in ahujasid blender‑mcp, but no further details such as PoC, exploit, or patch are provided.
00000170
57.6K followersView on X

Explore more

Back to dashboard