Homepage

Arbitrary Code Injection Affecting freecad package, versions <1.0.0+dfsg-8+deb13u3

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.2% (9th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ECHOLATEST-FREECAD-18674476
  • published12 Aug 2026
  • disclosed11 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 11 Aug 2026

CVE-2026-73233  (opens in a new tab)
CWE-94  (opens in a new tab)

How to fix?

Upgrade Echo:latest freecad to version 1.0.0+dfsg-8+deb13u3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream freecad package and not the freecad package as distributed by Echo. See How to fix? for Echo:latest relevant fixed versions and status.

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a Fem::ConstraintDisplacement object through TaskDlgFemConstraintDisplacement::accept() into Gui::Command::doCommand. The escaping helper neutralizes quotation marks but not backslashes, allowing crafted formula text to terminate the generated Python string and execute arbitrary Python code with the FreeCAD process's privileges when a victim accepts the dialog. This issue is fixed in version 1.1.2.