FreeCAD is a free and open-source multiplatform 3D parametric modeler. (CVE-2026-73233)
Description
FreeCAD versions prior to 1.1.2 contain a vulnerability in the FEM Displacement Constraint task dialog where crafted displacement formula inputs can lead to arbitrary Python code execution. This occurs because backslashes are not properly escaped, allowing an attacker to terminate the Python string and inject code when the dialog is accepted. The issue is fixed in version 1.1.2.
CVSS v4.0
Affected software
pkg:deb/ubuntu/freecad?arch=source&distro=xenialpkg:deb/ubuntu/freecad?arch=source&distro=bionicpkg:deb/ubuntu/freecad?arch=source&distro=focalpkg:deb/ubuntu/freecad?arch=source&distro=jammypkg:deb/ubuntu/freecad?arch=source&distro=stonkingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In FreeCAD before version 1.1.2, the FEM Displacement Constraint task dialog passes user-supplied displacement formula fields (xDisplacementFormula, yDisplacementFormula, zDisplacementFormula) into a Python command without properly escaping backslashes. Although quotation marks are neutralized, the lack of backslash escaping allows crafted input to terminate the Python string and execute arbitrary Python code with the privileges of the FreeCAD process when the user accepts the dialog. This vulnerability is resolved in FreeCAD version 1.1.2.
Potential Impact
An attacker who can supply crafted displacement formula input to the FEM Displacement Constraint dialog can execute arbitrary Python code with the privileges of the FreeCAD process. This could lead to unauthorized code execution on the victim's system when the dialog is accepted. The vulnerability requires user interaction (accepting the dialog) and local access to the application.
Mitigation Recommendations
Upgrade FreeCAD to version 1.1.2 or later, where this vulnerability is fixed. No other mitigations are specified. Users should avoid accepting untrusted displacement formula inputs in affected versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-73233
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:26.10"]
- Cvss Version
- 4.0
Threat ID: 6ad3f58b2cdf04f6566621ba
Added to database: 10/17/2026, 22:24:11 UTC
Last enriched: 10/17/2026, 23:47:25 UTC
Last updated: 10/17/2026, 23:47:25 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.