CVE-2026-34789
FreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
FreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.
- Record
CVE-2026-34789- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2026-60454
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.
- Record
EUVD-2026-60454- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.
- Record
CVE-2026-34789- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
FreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.
- Record
CVE-2026-34789- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-34789
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.
- Record
DEBIAN-CVE-2026-34789- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-34789
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.
- Record
UBUNTU-CVE-2026-34789- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freecadDebian:12 |
before 0.20.2+dfsg1-4+deb12u1, plus listed versions 0.20.2+dfsg1-4 |
0.20.2+dfsg1-4+deb12u1 |
freecadDebian:13 |
before 1.0.0+dfsg-8+deb13u3, plus listed versions 1.0.0+dfsg-81.0.0+dfsg-8+deb13u11.0.0+dfsg-8+deb13u2 |
1.0.0+dfsg-8+deb13u3 |
freecadDebian:14 |
before 1.1.3+dfsg-1, plus listed versions 1.0.0+dfsg-81.0.2+dfsg-11.0.2+dfsg-21.0.2+dfsg-31.0.2+dfsg-4 Show 11 moreShow less1.0.2+dfsg-51.0.2+dfsg-61.0.2+dfsg-71.0.2+dfsg-8~exp11.1.0+dfsg-11.1.0+dfsg-21.1.0+dfsg-2~exp11.1.1+dfsg-11.1.1+dfsg-21.1.1+dfsg-2~exp11.1.1+dfsg-3 |
1.1.3+dfsg-1 |
freecadUbuntu:16.04:LTS |
All versions, plus listed versions 0.14.3702+dfsg-40.15.4671+dfsg1-10.15.4671+dfsg1-20.15.4671+dfsg1-30.15.4671+dfsg1-4 |
None known |
freecadUbuntu:18.04:LTS |
All versions, plus listed versions 0.16+dfsg2-30.16+dfsg2-3build30.16.6712+dfsg1-10.16.6712+dfsg1-1ubuntu10.16.6712+dfsg1-1ubuntu2 |
None known |
freecadUbuntu:20.04:LTS |
All versions, plus listed versions 0.18.3+dfsg1-10.18.3+dfsg1-40.18.4+dfsg1-10.18.4+dfsg1-2~build10.18.4+dfsg1-2 Show 4 moreShow less0.18.4+dfsg1-2ubuntu80.18.4+dfsg2-1ubuntu10.18.4+dfsg2-1ubuntu20.18.4+dfsg2-1ubuntu4 |
None known |
freecadUbuntu:22.04:LTS |
All versions, plus listed versions 0.19.1+dfsg1-20.19.2+dfsg1-30.19.2+dfsg1-3ubuntu1 |
None known |
freecadUbuntu:26.10 |
All versions, plus listed versions 1.1.1+dfsg-31.1.1+dfsg-3build11.1.3+dfsg-3build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34789 is a high vulnerability (CVSS 7.0) in Freecad, published August 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in freecad 0.20.2+dfsg1-4+deb12u1.
References
github.com/FreeCAD/FreeCAD/security/advisories/GHSA-493w-pp4h-h77v