CVE-2025-3982
📋 TL;DR
This CVE describes a prototype pollution vulnerability in Sverchok 1.3.0's Set Property Mk2 Node. Attackers can remotely manipulate object prototypes to potentially modify application behavior or cause denial of service. Users of Sverchok 1.3.0 with the affected node enabled are vulnerable.
💻 Affected Systems
- nortikin Sverchok
📦 What is this software?
Sverchok by Nortikin
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through prototype pollution leading to complete system compromise, though this requires specific application context.
Likely Case
Application instability, denial of service, or unauthorized modification of object properties affecting 3D modeling operations.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially causing only minor application errors.
🎯 Exploit Status
Exploit code is publicly available in the GitHub gist reference. Attack requires network access to Blender's Sverchok interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider removing or disabling the Set Property Mk2 Node until a fix is released.
🔧 Temporary Workarounds
Disable Set Property Mk2 Node
allRemove or disable the vulnerable node from all Sverchok node trees
Manually edit .blend files to remove SvSetPropNodeMK2 nodes
Network Isolation
allRestrict network access to Blender instances running Sverchok
Use firewall rules to block external access to Blender's network ports
🧯 If You Can't Patch
- Isolate Blender instances with Sverchok from untrusted networks
- Implement strict input validation for all Sverchok node parameters
🔍 How to Verify
Check if Vulnerable:
Check if Sverchok 1.3.0 is installed and if any node trees contain Set Property Mk2 nodesCheck Version:
In Blender: Check Sverchok addon version in Preferences > Add-onsVerify Fix Applied:
Verify Sverchok version is updated beyond 1.3.0 or vulnerable nodes are removed📡 Detection & Monitoring
Log Indicators:
- Unusual network connections to Blender
- Sverchok node execution errors
- Unexpected object property modifications
Network Indicators:
- Traffic to Blender's network interface containing serialized node data
SIEM Query:
Search for process execution of blender.exe with network activity and error logs containing 'Sverchok' or 'SvSetPropNodeMK2'