CVE-2026-34789

Name of the Vulnerable Software and Affected Versions FreeCAD versions prior to 1.1.2

Description An issue exists in the PropertyPythonObject::Restore() function within src/App/PropertyPythonObject.cpp where the software passes an attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport ImportModule() during the restoration of a crafted FCStd document. This process allows for the execution of module-level Python code. Additionally, the legacy pickle branch imports an attacker-controlled module and invokes its class constructor via PyObject CallObject().

Recommendations Update to version 1.1.2.