- Vulnerability Spotlight: Multiple Unpatched Vulnerabilities in Blender Identified
- Talos security advisory for Blender product (TALOS-2017-0451)
Secondly, I'm not asking about discussion how dangerous is it, what's the BF stance on it and other unrelated things.
There are vulnerabilities, there is possibility to use them and that's all I care about in this question.
If you read from sources there are some vulnerabilities regarding opening .blend files which could be prepared to do nasty stuff.
I myself had couple of times thoughts about downloading .blend files from questions/answers but it was all. Still I've downloaded them, opened them and even run scripts inside them (if the question/answer needed them).
Citing from Talos:
An attacker could weaponize these vulnerabilities and utilize social engineering tactics in conjunction with a spear phishing email to remotely exploit and compromise a targeted user. Other possible scenarios where attackers could exploit and compromise users include cases were malicious files are uploaded to sites like GitHub, Google Drive, and Dropbox for sharing with intended victims.
In our case it's even easier. Attacker can just ask question with malicious file. I don't know statistic how many of users is downloading them from Q/A. Still this could be dangerous.
I know that you can't trust anything from the internet (yet it doesn't prevent from opening every .blend file from here) but .blend files are probably for many like .jpg. It's not .exe, .vbs, or .js so it can't be harmful right? Especially when it comes from good people that are politely asking us or answering our questions. They should be good. Right?
Should we in any way try to inform users that maybe not now, maybe not in near future but .blend files can be harmful for them?