CVE-2005-3302: Eval injection vulnerability in bvh_import.py in Blender 2.36 allows attackers to execute arbitrary Python...

Security readout for executives and security teams

A malicious .bvh motion-capture file could make Blender 2.36 run attacker-controlled Python when imported. This matters mainly for legacy creative workstations, render farms, or file-processing pipelines that still handle old Blender assets. The source bundle does not show active exploitation. Exposure is most likely in legacy Blender 2.36 installations or distribution packages containing the vulnerable bvh_import.py importer. Risk increases where untrusted .bvh files are imported, previewed, batch-converted, or processed automatically. Treat as a targeted legacy-software risk. Prioritize remediation where Blender processes external motion-capture files or runs in shared production pipelines. Modern environments without Blender 2.36 exposure are unlikely to need emergency action. Mitigation focus: Identify Blender 2.36 or vulnerable Blender packages in workstation and pipeline inventories.; Apply vendor or distribution guidance, including Debian DSA-1039 where relevant.; Block or quarantine untrusted .bvh files until vulnerable importers are removed..

Prepared

May 24, 2026, 09:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.