CVE-2026-34399: FreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw Page
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeCADto a version that resolves this vulnerability.Fixed in 1.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34399?
The severity of CVE-2026-34399 is rated as high with a score of 7.8.
How do I fix CVE-2026-34399?
To fix CVE-2026-34399, update FreeCAD to version 1.1.2 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2026-34399?
CVE-2026-34399 is an arbitrary code execution vulnerability that occurs via the eval() function on untrusted SVG template files.
Which FreeCAD versions are affected by CVE-2026-34399?
FreeCAD versions from 0.19 to 1.1.1 are affected by CVE-2026-34399.
What can an attacker do with CVE-2026-34399?
An attacker can execute arbitrary Python code on a user's system by exploiting CVE-2026-34399 through a malicious SVG template.