CVE-2026-34399

HighCVSS 7.8

Published: 17/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

FreeCAD from version 0.19 until 1.1.1 has a vulnerability in the BIM Workbench where an eval() call is made on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes.

Risk Assessment

A user could be tricked into using a malicious template, leading to arbitrary code execution on their system.

Recommendation

Upgrade FreeCAD to version 1.1.1 or later, which contains the fix.

Original NVD description (English source)

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1.