Language and package

C++

Native applications.

1 write-up, 2 vulnerabilities

CVE-2026-34398, CVE-2026-34399

7.8 · High

23 Jul 2026 8 min

Code execution through eval() in the FreeCAD BIM workbench

Two eval() calls in the FreeCAD BIM workbench ran Python read from project and drawing templates, so loading a crafted template executed attacker code.

Code injection
Code execution
Desktop software

Vulnerabilities

Identifier	Product	Vulnerability	CVSS	Published
CVE-2026-34398	FreeCAD	eval() on .FCStd metadata in the BIM Project Manager	7.8 High	23 Jul 2026
CVE-2026-34399	FreeCAD	eval() on the SVG template Scale field in the BIM TechDraw page	7.8 High	23 Jul 2026

All vulnerabilities