A severe eval injection vulnerability in FreeCAD permits arbitrary code execution when a victim opens a crafted project file.

This vulnerability involves the improper neutralization of directives in dynamically evaluated code (CWE-95). It functions similarly to CVE-2026-34398, where the application fails to safely handle input, allowing for command injection during file parsing.

The CVSS score of 7.8 reflects the high risk of this vulnerability. Exploitation allows an attacker to compromise the local workstation's security, potentially resulting in unauthorized access to sensitive CAD files and other proprietary information stored on the host system.

Immediate Action: Update all installations of FreeCAD to version 1.1.1 or later to ensure both this and related eval injection vulnerabilities are addressed.

Proactive Monitoring: Review security logs for suspicious execution patterns originating from the FreeCAD application process.

Compensating Controls: Enforce strict controls on the handling of external CAD project files and utilize endpoint detection and response tools to identify anomalous behavior during file import operations.

Public Exploit Available: No confirmed public exploit available.

Given the vulnerability type and the impact, it is critical to update to the latest version of FreeCAD. Users should exercise extreme caution regarding the origin of project files until the software is updated to a non-vulnerable version.