The vulnerability CVE-2026-10688 affects the ahujasid blender-mcp project up to commit 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. It involves code injection via manipulation of the 'code' argument in the execute_blender_code function in the server.py file. This flaw allows remote attackers to execute arbitrary code on the affected system. The project follows a rolling release strategy, making it difficult to specify exact affected or fixed versions. The issue was reported early to the project, but no response or remediation has been provided yet. The CVSS 4.0 base score is 5.1, reflecting medium severity with network attack vector, low complexity, and partial user interaction required.

Successful exploitation of this vulnerability allows remote attackers to inject and execute arbitrary code on the affected system via the execute_blender_code function. This can lead to unauthorized code execution, potentially compromising system integrity and confidentiality. The vulnerability is exploitable remotely and requires low attack complexity with some user interaction. However, the impact is rated medium due to limited scope and partial impact on confidentiality, integrity, and availability.

No official fix or patch is currently available for this vulnerability. The vendor has not responded to the issue report. Users should monitor the vendor's project repository or advisory channels for updates or patches. Until a fix is released, consider restricting access to the affected service to trusted users only and avoid passing untrusted input to the execute_blender_code function. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.