CVE-2026-73233

UNKNOWN 0.0

FreeCAD: FEM formula incomplete escape

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a Fem::ConstraintDisplacement object through TaskDlgFemConstraintDisplacement::accept() into Gui::Command::doCommand. The escaping helper neutralizes quotation marks but not backslashes, allowing crafted formula text to terminate the generated Python string and execute arbitrary Python code with the FreeCAD process's privileges when a victim accepts the dialog. This issue is fixed in version 1.1.2.

CWE	CWE-94
Vendor	freecad
Product	freecad
Published	Aug 11, 2026
Last Updated	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for freecad freecad

Be the first to know when new unknown vulnerabilities affecting freecad freecad are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

FreeCAD / FreeCAD

< 1.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-2rq3-gx3h-489q github.com: https://github.com/FreeCAD/FreeCAD/pull/31267 github.com: https://github.com/FreeCAD/FreeCAD/pull/31312 github.com: https://github.com/FreeCAD/FreeCAD/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2 github.com: https://github.com/FreeCAD/FreeCAD/commit/3f60d202a8246958232e2fbc74ba38a83483b74e github.com: https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2