blender-hardsurface

This file is not itself executing untrusted code, but it is a thin client that can request server-side execution of attacker-supplied code via an explicit 'execute_code' command. Combined with a lack of authentication/integrity controls, this is a significant security red flag if the paired localhost service is untrusted, compromised, or exposed beyond intended trust boundaries. Otherwise, for tightly controlled internal testing environments, the risk may be lower; however, the capability is inherently high-privilege.