If you're a game developer using a popular AI-powered asset tool to speed up your workflow, an attacker on the internet could already be reading files off your computer — including API keys, credentials, and private project data — without you ever knowing.
Who's At Risk — and Why It Matters
Game development has quietly become one of the fastest-growing use cases for AI tooling. Independent developers, small studios, and hobbyists are increasingly relying on automated pipelines to generate 3D assets, textures, and models — shaving weeks off production timelines. One such tool, mcp-game-asset-gen, built by developer Flux159, sits squarely in that workflow. It's a lightweight server component — version 0.1.0 — designed to integrate with AI model interfaces and convert images into 3D game-ready assets.
The vulnerability, now tracked as CVE-2026-7594 and rated HIGH severity, means anyone running this tool on their development machine may be exposing their entire file system to remote attackers. That includes environment files holding cloud credentials, SSH private keys, source code, and anything else stored on the same machine. For indie developers who often work from personal laptops where work and personal data mix freely, the blast radius is significant. For small studios running shared development servers, it's potentially catastrophic.
What an Attacker Can Actually Do
Imagine you've set up this tool to help you convert concept art into 3D models. Behind the scenes, the software runs a small server that listens for instructions — one of those instructions involves tracking the status of a conversion job by reading a file on your disk. The problem is the software never checks which file it's been told to read. An attacker can send a specially crafted request that manipulates the file path — essentially telling the tool, "don't read the status file, read this other file instead" — and the software dutifully complies.
It's the digital equivalent of a delivery driver who's supposed to pick up a package from apartment 4B, but someone slips them a note that says "actually go to the filing cabinet in the basement and bring me everything inside." The driver follows instructions without questioning whether they should. In this case, the "basement filing cabinet" could be your .env file full of API secrets, your SSH configuration, your git credentials, or anything else the operating system allows the tool's process to access.
What makes this particularly dangerous is that the attack works remotely. The attacker doesn't need physical access to your machine or even to be on the same network, depending on how the tool is configured. And because a working exploit has already been made public, the barrier for a malicious actor to attempt this is now extremely low — this is no longer theoretical.
The Technical Detail That Should Concern Researchers
For the security professionals in the room: the vulnerable function is image_to_3d_async() located in src/index.ts, part of the tool's MCP (Model Context Protocol) Interface. The statusFile argument passed to this function undergoes no sanitization or path normalization before being used in a file system read operation. This is a classic path traversal vulnerability (CWE-22), allowing directory escape sequences such as ../../ to break out of any intended working directory. The flaw has been assigned a CVSS score of 7.3 (HIGH) and is exploitable cross-platform — meaning Windows, macOS, and Linux development environments are all equally affected.
How This Was Found — and the Silence That Followed
The vulnerability was discovered and responsibly reported to the project maintainer through an issue report before public disclosure — a process security researchers call "coordinated disclosure." The goal of that process is to give developers a window of time to fix the problem before details go public, protecting users in the meantime. In this case, the maintainer did not respond. With no acknowledgment and no patch forthcoming, the vulnerability details were made public, and CVE-2026-7594 was formally assigned.
As of publication, there are no confirmed active exploitation campaigns targeting this vulnerability in the wild. However, the exploit is now public knowledge. Security teams monitoring developer toolchains and supply chains should treat this as an active risk, not a future concern. The window between "exploit goes public" and "exploit gets used" has historically been measured in days, not months.
It's worth noting this vulnerability sits in an increasingly crowded and under-scrutinized category: AI developer tooling. These tools are adopted rapidly, often by individual developers who lack dedicated security review processes, and they frequently run with broad file system permissions by design. This won't be the last vulnerability of this type.
What You Should Do Right Now
If you are using mcp-game-asset-gen version 0.1.0 — currently the only released version — take the following steps immediately:
- Stop running the tool until a patched version is released. There is no fixed version available as of this writing. Continuing to run version 0.1.0 in any internet-accessible environment is not advisable. Check the project's GitHub repository for updates and watch for a version higher than 0.1.0 before resuming use.
-
Audit your environment for exposed credentials. If you have been running this tool, assume your file system was potentially accessible. Rotate any API keys, tokens, or passwords stored in
.envfiles,~/.ssh/,~/.aws/credentials, or similar locations on the same machine. Revoke and regenerate — don't just change passwords in place. - If you must continue working, isolate the tool in a sandboxed environment. Run it inside a Docker container with a strictly limited volume mount — map only the specific directory the tool needs, not your home directory or project root. Use a dedicated container user with minimal OS-level permissions. This won't fix the vulnerability, but it significantly limits what an attacker can reach if they exploit it.
CVE: CVE-2026-7594 | CVSS: 7.3 HIGH | Affected version: mcp-game-asset-gen 0.1.0 | Status: No patch available at time of publication