CyberRota Analysis
AI-GeneratedFreeCAD versions prior to 1.1.2 are vulnerable to a high-severity code execution flaw due to improper handling of attacker-controlled module attributes during the restoration of crafted FCStd documents. This vulnerability allows an attacker to execute arbitrary Python code, potentially compromising the integrity and confidentiality of the system. Organizations using FreeCAD for 3D modeling should prioritize upgrading to version 1.1.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.