CVE-2026-34398 | CyberRota

CyberRota Analysis

AI-Generated

The vulnerability allows arbitrary Python code execution in FreeCAD's BIM Project Manager when loading a malicious project template due to unsafe handling of user-controlled Meta property values. This poses a significant risk, as it can lead to remote code execution on affected systems running versions 0.19 to 1.1.1. Users and organizations utilizing FreeCAD for 3D modeling, particularly in collaborative environments, should prioritize updating to version 1.1.1 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals

code execution

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-34398

Severity

HIGH

CVSS

7.8

EPSS

0.22%

Original NVD Description

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template. This issue is fixed in version 1.1.1.