blender

This module is a high-impact localhost HTTP bridge that functions as an explicit unauthenticated code-execution interface: /run accepts caller-supplied Python (or reads it from an attacker-supplied file path) and executes it via exec() in Blender’s main process with access to bpy and os. The access-control mechanism is header-based and not an effective authorization boundary. It also enables filesystem and render output side effects and returns internal state and tracebacks over HTTP. Treat as extremely suspicious/unsafe for any environment where untrusted local code could reach the listening port.