Freecad
Monthly
Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.
Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.
Remote code execution via crafted .FCStd document in FreeCAD prior to 1.1.2 allows arbitrary Python execution when a victim opens a malicious file. The deserialization path in PropertyPythonObject::Restore() passes attacker-controlled module names directly to PyImport_ImportModule(), executing module-level Python code on import; the legacy pickle branch additionally invokes an attacker-controlled class constructor via PyObject_CallObject(). No public exploit or CISA KEV listing is identified at time of analysis, but exploit construction is straightforward for any researcher who can craft the FCStd XML schema.
Arbitrary Python code execution in FreeCAD's BIM module (versions 0.19 through pre-1.1.1) is triggered when a user opens a malicious project template file through the BIM Project Manager's Load Template function. The loadTemplate() method in BimProjectManager.py passes FCStd metadata fields (wpposition, wpu, wpv, wpaxis) directly to Python's built-in eval(), enabling an attacker who can deliver a crafted template to achieve full code execution under the victim's user account. No public exploit has been identified at time of analysis; the vendor-released patch is confirmed in version 1.1.1.
Arbitrary Python code execution in FreeCAD's BIM Workbench (versions 0.19 through 1.1.0) is triggered when a user creates a TechDraw page from a malicious SVG template, due to an unsafe eval() call in BimTDPage.py at line 87. Exploitation requires social engineering - an attacker must deliver a crafted SVG template to a victim who then performs the TechDraw page creation action. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the vulnerability is structurally trivial (direct eval of attacker-controlled input, CWE-95) and the fix is available in version 1.1.1.
Remote code execution via crafted .FCStd document in FreeCAD prior to 1.1.2 allows arbitrary Python execution when a victim opens a malicious file. The deserialization path in PropertyPythonObject::Restore() passes attacker-controlled module names directly to PyImport_ImportModule(), executing module-level Python code on import; the legacy pickle branch additionally invokes an attacker-controlled class constructor via PyObject_CallObject(). No public exploit or CISA KEV listing is identified at time of analysis, but exploit construction is straightforward for any researcher who can craft the FCStd XML schema.