A critical eval injection vulnerability in FreeCAD enables attackers to execute arbitrary code when a user opens a specially crafted project file.

This is an improper neutralization of directives in dynamically evaluated code (CWE-95) vulnerability. The attack requires a user to interact with the software by opening a malicious file, making it a client-side execution risk.

With a CVSS score of 7.8, this vulnerability carries high risk. Successful exploitation results in full control over the user's local machine, potentially leading to the theft of intellectual property, sensitive design data, or the installation of persistent backdoors on engineering workstations.

Immediate Action: Update to FreeCAD version 1.1.1 or later immediately to resolve the eval injection flaw.

Proactive Monitoring: Monitor file integrity on workstations that process external CAD files and review system process logs for unexpected child processes spawned by FreeCAD.

Compensating Controls: Advise users to only open project files from trusted sources and consider running FreeCAD in a restricted environment or virtual machine to isolate potential threats.

Public Exploit Available: No confirmed public exploit available.

The risk of code execution via malicious files is high for any organization utilizing FreeCAD for design workflows. Organizations must mandate the update to version 1.1.1 across all workstations to neutralize this threat.