CVE-2026-34399 FreeCAD CVE debrief

Who should care

Defenders and administrators of FreeCAD deployments, especially those processing untrusted SVG templates, should assess exposure and prioritize verification and remediation. This includes reviewing FreeCAD version and exposure, restricting access to BIM Workbench and TechDraw pages, and validating and sanitizing SVG template inputs. Security teams should also consider additional security controls to mitigate potential impacts.

Why it matters

CVE-2026-34399 allows arbitrary Python code execution in FreeCAD's BIM Workbench when creating a TechDraw page from a malicious SVG template. Defenders should prioritize verifying exposure, especially in deployments processing untrusted templates, and consider updating to version 1.1.1. Additional security controls may be necessary to mitigate potential impacts.

• Potential for arbitrary Python code execution
• Possible disruption to design and modeling workflows
• Need for verification of FreeCAD version and exposure
• Potential requirement for additional security controls

Technical summary

The eval() call on untrusted SVG template data in FreeCAD's BIM Workbench allows arbitrary Python code execution when creating a TechDraw page. This issue is fixed in version 1.1.1. The vulnerable code is located in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). Defenders should prioritize verifying exposure in FreeCAD deployments, especially where untrusted SVG templates are processed, and consider updating to version 1.1.1. Additional security controls may be necessary to mitigate potential impacts. The CVE record and NVD entry provide details on the vulnerability, but there is limited information on potential exploitation or affected systems.

Defensive priority

Defenders should prioritize verifying exposure in FreeCAD deployments, especially where untrusted SVG templates are processed.

Recommended defensive actions

• Verify FreeCAD version and update to 1.1.1 if vulnerable
• Restrict access to BIM Workbench and TechDraw pages
• Validate and sanitize SVG template inputs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, additional information on potential exploitation or affected systems is limited. Defenders should verify FreeCAD version and exposure, especially where untrusted SVG templates are processed. The eval() call on untrusted SVG template data in FreeCAD's BIM Workbench allows arbitrary Python code execution when creating a TechDraw page. There is no evidence of public exploitation, but defenders should prioritize verification and remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.