CVE-2026-73233 in FreeCAD
Summary
by MITRE • 08/11/2026
FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a Fem::ConstraintDisplacement object through TaskDlgFemConstraintDisplacement::accept() into Gui::Command::doCommand. The escaping helper neutralizes quotation marks but not backslashes, allowing crafted formula text to terminate the generated Python string and execute arbitrary Python code with the FreeCAD process's privileges when a victim accepts the dialog. This issue is fixed in version 1.1.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability resides within FreeCAD's Finite Element Method implementation where the FEM Displacement Constraint task dialog fails to properly sanitize user input before executing Python commands. The flaw exists in the file src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp where three formula fields xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula are processed through the TaskDlgFemConstraintDisplacement::accept() method. When a user accepts the dialog, these values are passed directly to Gui::Command::doCommand without adequate input validation or escaping. The escaping mechanism in place only neutralizes quotation marks but leaves backslashes unescaped, creating an exploitable condition where malicious input can terminate Python string literals and inject arbitrary code execution.
This represents a classic command injection vulnerability classified as CWE-78 within the Common Weakness Enumeration framework, specifically targeting Python command execution through improper input sanitization. The attack vector leverages the trust model between the GUI interface and underlying command execution engine, where user-provided data flows directly into interpreted Python commands without proper contextual escaping. The vulnerability operates at the intersection of input validation and code generation, where the system assumes all user input is benign and safe for direct interpretation.
The operational impact extends beyond simple code execution as the malicious payload runs with the privileges of the FreeCAD process itself, potentially allowing attackers to access sensitive data, modify files, or execute additional malicious operations on the victim's system. Since FreeCAD is a multiplatform 3d parametric modeler used in engineering and design environments, this vulnerability could be exploited in contexts where users might encounter specially crafted models or constraints, particularly in collaborative or shared design scenarios where untrusted input is common. The exploitation requires user interaction through dialog acceptance, making it a client-side privilege escalation vulnerability that can lead to complete system compromise.
Mitigation strategies should focus on implementing comprehensive input sanitization that properly escapes all special characters including backslashes and other Python string terminators. The fix in version 1.1.2 addresses this by ensuring proper escaping of all potentially dangerous characters rather than relying on partial sanitization. Organizations should implement input validation at multiple layers, including GUI input sanitization, command generation escaping, and runtime environment restrictions to prevent arbitrary code execution. Additionally, the vulnerability highlights the importance of following secure coding practices such as those outlined in the OWASP Secure Coding Practices and ATT&CK framework's T1059.001 technique for command injection, emphasizing that all user-provided data must be treated as potentially malicious and properly validated before any interpretation or execution occurs.