CVE-2026-34789

Published: Aug 17, 2026Modified: Aug 19, 2026

7.0

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.0 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (6)

https://github.com/FreeCAD/FreeCAD/commit/81b73925ce22610542367301d8eff4259eb9596e

Source: security-advisories@github.com

https://github.com/FreeCAD/FreeCAD/commit/983037f3003dc31f48db36705b86fb3fbe026295

Source: security-advisories@github.com

https://github.com/FreeCAD/FreeCAD/commit/e2dc6c8172673642c6856b8b3a5a6accefb18279

Source: security-advisories@github.com

https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2

Source: security-advisories@github.com

https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-493w-pp4h-h77v

Source: security-advisories@github.com

https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-493w-pp4h-h77v

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.