CVE-2026-73233 FreeCAD CVE debrief

Who should care

Defenders responsible for FreeCAD deployments, especially in environments where untrusted input is processed, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-73233 is a high-severity vulnerability in FreeCAD that allows arbitrary Python code execution via crafted formula text in the FEM Displacement Constraint task dialog. Defenders should prioritize verifying exposure, especially in environments where untrusted input is processed, and assess the need for compensating controls. The vulnerability is fixed in version 1.1.2.

• Potential for arbitrary Python code execution with FreeCAD process privileges
• Need for verification of exposure in FreeCAD deployments
• Possible impact on data integrity and system security
• Requirement for prompt remediation to prevent exploitation

Technical summary

The FEM Displacement Constraint task dialog in FreeCAD versions prior to 1.1.2 passes user-input formula text through TaskDlgFemConstraintDisplacement::accept() into Gui::Command::doCommand without proper escaping of backslashes, allowing crafted formula text to terminate the generated Python string and execute arbitrary Python code with the FreeCAD process's privileges. This issue is fixed in version 1.1.2. The vulnerability affects FreeCAD deployments, especially in environments where untrusted input is processed, and defenders should prioritize verifying exposure and assessing the need for compensating controls.

Defensive priority

Defenders should prioritize verifying exposure in FreeCAD deployments, especially where untrusted input is processed, and assess the need for compensating controls.

Recommended defensive actions

• Verify FreeCAD deployments for version 1.1.2 or later
• Assess exposure in environments where untrusted input is processed
• Implement compensating controls to restrict Python execution
• Monitor for suspicious activity in FreeCAD logs
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides details on the vulnerability in FreeCAD's FEM Displacement Constraint task dialog, which allows crafted formula text to execute arbitrary Python code. However, specific details about exploitation, victims, or business impact are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.