What is the CVSS score of CVE-2026-34399?

CVE-2026-34399 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of FreeCAD are affected by CVE-2026-34399?

FreeCAD versions 0.19 through 1.1.0 contain an arbitrary Python code execution vulnerability in the BIM Workbench.. A patch is available.

How to fix or mitigate CVE-2026-34399?

Within 24 hours, inventory FreeCAD installations identifying BIM Workbench users. Within 7 days, upgrade all affected systems to version 1.1.1 or later to eliminate the unsafe eval() vulnerability in BimTDPage.py. Within 30 days, verify upgrade completion and implement controls restricting SVG template sources to pre-approved vendors.

FreeCAD CVE-2026-34399

EUVD-2026-60456 HIGH

Eval Injection (CWE-95)

2026-08-17 GitHub_M

RCE Python Code Injection Freecad

7.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File-based delivery mandates AV:L; attacker needs no privileges (PR:N) but victim must actively process the template (UI:R); full code execution yields C:H/I:H/A:H with no scope change.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 17, 2026 - 22:03 EUVD

Source Code Evidence Fetched

Aug 17, 2026 - 21:32 vuln.today

Analysis Generated

Aug 17, 2026 - 21:32 vuln.today

CVE Published

Aug 17, 2026 - 20:50 cve.org

HIGH 7.8

DescriptionCVE.org

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1.

Articles & Coverage 1

News 10 New Python Vulnerabilities - 3 Critical, 7 High, 2 With POC Aug 18, 2026

AnalysisAI

Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.

Technical ContextAI

FreeCAD's BIM Workbench includes a TechDraw page creation workflow implemented in Python at src/Mod/BIM/bimcommands/BimTDPage.py. At line 87, the code passes content extracted from user-supplied SVG template files directly to Python's eval() built-in without any sanitization or sandboxing. CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code - Eval Injection) is the root cause class: attacker-controlled strings are treated as executable Python expressions by the interpreter. Because FreeCAD's BIM and TechDraw modules are written in Python, successful injection executes with the same Python runtime context as the main application, providing full access to OS-level APIs via standard library modules. Affected CPE: cpe:2.3:a:freecad:freecad:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to FreeCAD 1.1.1, which contains the confirmed fix for the eval() injection in BimTDPage.py, as documented in the official release at https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.1 and vendor security advisory GHSA-chv4-vm6r-wjqj. For users who cannot update immediately, restrict the BIM Workbench's TechDraw page creation feature to SVG templates sourced exclusively from trusted internal repositories and avoid opening template files received from external parties. Disabling the BIM Workbench entirely via FreeCAD's preferences eliminates the attack surface with the trade-off of losing all BIM functionality. Do not rely solely on user training as a compensating control given the structural nature of the flaw.