CVE-2026-34398 FreeCAD: Arbitrary Code Execution via eval() on untrusted project file metadata in BIM Workbench
Attackers can execute arbitrary Python code by tricking users into loading malicious BIM project templates in FreeCAD.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34398?
CVE-2026-34398 is a high-severity code injection vulnerability in FreeCAD, published on 17 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template. This issue is fixed in version 1.1.1.
Weakness: CWE-95
Which versions are affected by CVE-2026-34398?
How do I fix CVE-2026-34398?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-34398 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34398 exists.
Sources
Also known as DEBIAN-CVE-2026-34398, GHSA-8rfj-7956-6gwf, UBUNTU-CVE-2026-34398.