VAITP Dataset

← Back to the dataset

CVE-2026-34399

Arbitrary code execution in FreeCAD's BIM Workbench via SVG templates.

  • CVSS 7.8
  • 95
  • Input Validation and Sanitization
  • Local

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1.

CVE
CVE-2026-34399
CWE
95
CVSS base score
7.8
Published
2026-08-17
OWASP
A03 Injection
Orthogonal defect classification
Checking
Code defect classification
Missing Check
Category
Input Validation and Sanitization
Subcategory
Command Injection
Accessibility scope
Local
Impact
Arbitrary Code Execution
Affected component
FreeCAD

Solution

Upgrade FreeCAD to version 1.1.1 or later.

Vulnerable code sample

import FreeCAD
import FreeCADGui

class BimTDPage:
    def activated(self, name="TDPage"):
        template = FreeCADGui.ActiveDocument.addObject("TechDraw::DrawSVGTemplate", "Template")
        page = FreeCADGui.ActiveDocument.addObject("TechDraw::DrawPage", "Page")
        page.Template = template

        # template.Template.Content contains the SVG file content as a string
        for o in template.Template.Content.splitlines():
            if "freecad:editable=" in o:
                text = o.split("freecad:editable=")[1].split('"')[1]
                # VULNERABLE: Data from the SVG template is evaluated as Python code.
                d = eval(text)
                if d and "object" in d:
                    obj = FreeCAD.ActiveDocument.getObject(d["object"])
        return page

Patched code sample

import json
import FreeCAD
import FreeCADGui

class BimTDPage:
    def activated(self, name="TDPage"):
        template = FreeCADGui.ActiveDocument.addObject("TechDraw::DrawSVGTemplate", "Template")
        page = FreeCADGui.ActiveDocument.addObject("TechDraw::DrawPage", "Page")
        page.Template = template

        # template.Template.Content contains the SVG file content as a string
        for o in template.Template.Content.splitlines():
            if "freecad:editable=" in o:
                text = o.split("freecad:editable=")[1].split('"')[1]
                try:
                    # FIX: Use json.loads() for safe parsing of structured data instead of eval().
                    d = json.loads(text)
                except Exception:
                    continue
                if d and "object" in d:
                    obj = FreeCAD.ActiveDocument.getObject(d["object"])
        return page

Payload

__VAITP_MODEL_REFUSED__

Cite this entry

@misc{vaitp:cve202634399,
  title        = {{Arbitrary code execution in FreeCAD's BIM Workbench via SVG templates.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-34399},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-34399/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::