blender-threejs-export
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script dynamically generates Python code and sends it to a local Blender instance via a TCP socket for execution. CLI arguments such as
--nameand--outputare interpolated into this Python code (e.g.,filepath="${pyPath}") inscripts/blender-threejs-export.js. ThepyPathvariable only escapes backslashes and fails to sanitize double quotes, which allows an attacker to break out of the string literal and execute arbitrary Python commands within the Blender process context. - [EXTERNAL_DOWNLOADS]: The generated HTML viewer references external JavaScript libraries and assets from a third-party CDN. Specifically, it loads the Three.js engine and its Draco decoder from
https://cdn.jsdelivr.net/npm/three@0.170.0/. These resources are fetched at runtime when the generated HTML file is opened in a web browser.
Audit Metadata