CVE-2026-34398: FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template. This issue is fixed in version 1.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeCADto a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34398?
The severity of CVE-2026-34398 is high with a CVSS score of 7.8.
How do I fix CVE-2026-34398?
To fix CVE-2026-34398, upgrade FreeCAD to version 1.1.2 or later where the vulnerability has been patched.
What kind of vulnerability is CVE-2026-34398?
CVE-2026-34398 is an arbitrary code execution vulnerability caused by unsafe use of eval() on untrusted project file metadata.
Which versions of FreeCAD are affected by CVE-2026-34398?
FreeCAD versions from 0.19 up to 1.1.1 are affected by CVE-2026-34398.
What can attackers do exploiting CVE-2026-34398?
Attackers exploiting CVE-2026-34398 can execute arbitrary code on the user's system by modifying untrusted project file metadata.