Description
Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute arbitrary Python code via a hierarchy element in a .bvh file, which is supplied to an eval function call.
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Joxean Koret · textwebappscgi
https://www.exploit-db.com/exploits/27728
References (4)
Core 4
Core References
Broken Link third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/19754
Broken Link, Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/17663
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2006/dsa-1039
Exploit, Mailing List, Third Party Advisory x_refsource_misc
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=330895
Scores
CVSS v3
7.3
EPSS
0.0620
EPSS Percentile
90.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-94
Status
published
Products (2)
blender/blender
2.36
debian/debian_linux
3.1
Published
Oct 24, 2005
Tracked Since
Feb 18, 2026