{"id":"CVE-2026-34789","summary":"FreeCAD: Arbitrary code execution via unsandboxed PyImport_ImportModule in PropertyPythonObject::Restore","details":"FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.","aliases":["GHSA-493w-pp4h-h77v"],"modified":"2026-09-11T08:25:08.222251Z","published":"2026-08-17T20:47:52.373Z","database_specific":{"cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34789.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34789.json"},{"type":"ADVISORY","url":"https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-493w-pp4h-h77v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34789"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/commit/81b73925ce22610542367301d8eff4259eb9596e"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/commit/983037f3003dc31f48db36705b86fb3fbe026295"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/commit/e2dc6c8172673642c6856b8b3a5a6accefb18279"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freecad/freecad","events":[{"introduced":"0"},{"fixed":"81b73925ce22610542367301d8eff4259eb9596e"},{"fixed":"983037f3003dc31f48db36705b86fb3fbe026295"},{"fixed":"e2dc6c8172673642c6856b8b3a5a6accefb18279"},{"fixed":"6c24c1ac45f312fc6b604a076ea4cb0664d0c5ca"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.1.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.1.1","weekly-2026.04.01","1.1.0","weekly-2026.03.25","weekly-2026.03.19","weekly-2026.03.18","weekly-2026.03.11","weekly-2026.03.04","weekly-2026.02.25","1.1rc3","weekly-2026.02.18","weekly-2026.02.11","weekly-2026.02.04","weekly-2026.01.28","weekly-2026.01.21","weekly-2026.01.14","1.1rc2","weekly-2026.01.07","weekly-2025.12.31","weekly-2025.12.24","weekly-2025.12.17","weekly-2025.12.10","weekly-2025.12.03","1.1rc1","weekly-2025.11.26","weeklies","weekly-2025.11.20","weekly-2025.11.19","weekly-2025.11.12","weekly-2025.11.05","weekly-2025.11.02","weekly-2025.10.31","weekly-2025.10.29","weekly-2025.10.22","weekly-2025.10.15","weekly-2025.10.08","weekly-2025.10.01","weekly-2025.09.24","weekly-2025.09.17","weekly-2025.09.12","weekly-2025.09.11","weekly-2025.09.10","weekly-2025.09.03","weekly-2025.08.27","weekly-2025.08.20","weekly-2025.08.13","weekly-2025.08.07","weekly-2025.08.05","weekly-2025.08.04","weekly-2025.07.29","weekly-2025.07.28","weekly-2025.07.26","weekly-2025.07.25","weekly-2025.07.24","weekly-2025.07.21","weekly-2025.07.14","weekly-2025.07.07","weekly-2025.06.30","weekly-2025.06.23","weekly-2025.06.16","weekly-2025.06.09","weekly-2025.06.02","weekly-2025.05.26","weekly-2025.05.19","weekly-2025.05.13","weekly-2025.05.02","weekly-2025.05.06","weekly-2025.04.28","weekly-2025.04.21","0.21rc1","0.20","0.20beta1","0.19","0.18","0.17","0.16"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34789.json","vanir_signatures_modified":"2026-09-11T08:25:08Z","vanir_signatures":[{"target":{"file":"src/App/PropertyPythonObject.h"},"deprecated":false,"digest":{"line_hashes":["320931381435368551458503512689726560362","91319553675193963477854924213293942672","294662725752338457717555606585546861538","270587024512162405589596588707704578700"],"threshold":0.9},"id":"CVE-2026-34789-073fd4b0","signature_type":"Line","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/983037f3003dc31f48db36705b86fb3fbe026295"},{"source":"https://github.com/freecad/freecad/commit/983037f3003dc31f48db36705b86fb3fbe026295","target":{"file":"src/App/PropertyPythonObject.cpp","function":"PropertyPythonObject::Restore"},"deprecated":false,"digest":{"function_hash":"980879606116961424568499125119397203","length":2376},"id":"CVE-2026-34789-483292e1","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"235633813084253699391269729123140217442","length":673},"id":"CVE-2026-34789-603cbef7","signature_type":"Function","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/81b73925ce22610542367301d8eff4259eb9596e","target":{"file":"src/App/PropertyPythonObject.cpp","function":"PropertyPythonObject::loadPickle"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["5683349394544919976044831017262240986","47102035039615780397088208234839999303","312148166039670913665097997159052954749","75385275148118409716428824373061967985","260689229913478622371945821973563703973","191230070533806645743461502890067724452","8481993002838957008263507837277574742","292697738948887117876470896400107043281","330198928968771380581740347803011435150","146755397714440435140305011896789223558","328722434367283817851733245697854935989","91709169852800812438950621057012688572","93711986165306467145029199812009318791","327504035189267809137850565790322094585","271719677904635959007740437698881840004","304002850741175424906974113797450193212","64022392709602593981867260245416778053","112501183018547696591722150090669698916","106377000052873512023798437738529133735","304321498750480412003669592935218276526","160542698083423279543441578258008691511","272376941672843677814232771307434253168","265490783789411377170278393524697800165","207154641776454225582288851392772925241","170239911610878359585478969309901432165","93944957318661059428101375606839097974","97016683591133141729246680420815687136","178562068265420269842188479084099126022","210096417304621687242411374132204699097","274853119427417998216479747082904467461","291049782139653038680607723000435495801","215650816578212427291775530686906784029","336833606227243785174665473397019733170","148212730739781061787551683404624631851","21527291425022453029565706899301957184","340257845967888740548011011992014336209","202321311375150052470650788692273444931","237628067031726864539497538879082078471","296537481235954150127037321381084193321","234219019380498236634109225420038201323","40203955879870544882391298933408510498","6328991658290264861710761241810839326","165505372971082141046659882720693127434","112501183018547696591722150090669698916","180864558240911336909857320070541382471","195639374917137645877143977873736573517","135788053362646545888810020165504790331","118261498515762014706386277786573874469","203003729714108050715951273495629551371","57805453849305370652701026276656095462","248077593511199665109571109251181330725","134601254131850702989370170459826176731","45542259311989191886621144492582551218","239266394176331289007867777763570725727","320907963550833647544801558672122491561","23577404123340264274149521766698982645","127421527487825639362565076637952029154","132792210043210897727804729929370982503","232899632977646300133921111482911754798","323998144061469323126969793448429976338","64490759519163456179854778373722735838","13480586233670237179781939778583845488","108524327102516027552453148561904704361","123798286589412604064541564481648386456","210937862636391257448541494323386206538","169482387269097397138545361663940081382","148508146429907783187962711838172363782","135991341554955384587268288036032798111","129340792537769589758740644525667512329","289250528228690026595307098278024189407","34776132644105422063898912277820687280","74037645248510369735672177666610845138","95666559732615663556292856186415708576","123616698038351304654221712909442681911","62319916078302896046159815075174075879","88048777121839790199840046554105235061","316790250262355761418853986988939815779"]},"id":"CVE-2026-34789-61e27dcf","signature_type":"Line","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/81b73925ce22610542367301d8eff4259eb9596e","target":{"file":"src/App/PropertyPythonObject.cpp"}},{"target":{"file":"src/App/PropertyPythonObject.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["320931381435368551458503512689726560362","91319553675193963477854924213293942672","294662725752338457717555606585546861538","270587024512162405589596588707704578700"]},"id":"CVE-2026-34789-6d392bb6","signature_type":"Line","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/81b73925ce22610542367301d8eff4259eb9596e"},{"source":"https://github.com/freecad/freecad/commit/983037f3003dc31f48db36705b86fb3fbe026295","target":{"file":"src/App/PropertyPythonObject.cpp"},"deprecated":false,"digest":{"line_hashes":["5683349394544919976044831017262240986","47102035039615780397088208234839999303","312148166039670913665097997159052954749","75385275148118409716428824373061967985","260689229913478622371945821973563703973","191230070533806645743461502890067724452","8481993002838957008263507837277574742","292697738948887117876470896400107043281","330198928968771380581740347803011435150","146755397714440435140305011896789223558","328722434367283817851733245697854935989","91709169852800812438950621057012688572","93711986165306467145029199812009318791","327504035189267809137850565790322094585","271719677904635959007740437698881840004","304002850741175424906974113797450193212","64022392709602593981867260245416778053","112501183018547696591722150090669698916","106377000052873512023798437738529133735","304321498750480412003669592935218276526","160542698083423279543441578258008691511","272376941672843677814232771307434253168","265490783789411377170278393524697800165","207154641776454225582288851392772925241","170239911610878359585478969309901432165","93944957318661059428101375606839097974","97016683591133141729246680420815687136","178562068265420269842188479084099126022","210096417304621687242411374132204699097","274853119427417998216479747082904467461","291049782139653038680607723000435495801","215650816578212427291775530686906784029","336833606227243785174665473397019733170","148212730739781061787551683404624631851","21527291425022453029565706899301957184","340257845967888740548011011992014336209","202321311375150052470650788692273444931","237628067031726864539497538879082078471","296537481235954150127037321381084193321","234219019380498236634109225420038201323","40203955879870544882391298933408510498","6328991658290264861710761241810839326","165505372971082141046659882720693127434","112501183018547696591722150090669698916","180864558240911336909857320070541382471","195639374917137645877143977873736573517","135788053362646545888810020165504790331","118261498515762014706386277786573874469","203003729714108050715951273495629551371","57805453849305370652701026276656095462","248077593511199665109571109251181330725","134601254131850702989370170459826176731","45542259311989191886621144492582551218","239266394176331289007867777763570725727","320907963550833647544801558672122491561","23577404123340264274149521766698982645","127421527487825639362565076637952029154","132792210043210897727804729929370982503","232899632977646300133921111482911754798","323998144061469323126969793448429976338","64490759519163456179854778373722735838","13480586233670237179781939778583845488","108524327102516027552453148561904704361","123798286589412604064541564481648386456","210937862636391257448541494323386206538","169482387269097397138545361663940081382","148508146429907783187962711838172363782","135991341554955384587268288036032798111","129340792537769589758740644525667512329","289250528228690026595307098278024189407","34776132644105422063898912277820687280","74037645248510369735672177666610845138","95666559732615663556292856186415708576","123616698038351304654221712909442681911","62319916078302896046159815075174075879","88048777121839790199840046554105235061","316790250262355761418853986988939815779"],"threshold":0.9},"id":"CVE-2026-34789-abe85d90","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/freecad/freecad/commit/81b73925ce22610542367301d8eff4259eb9596e","target":{"file":"src/App/PropertyPythonObject.cpp","function":"PropertyPythonObject::Restore"},"deprecated":false,"digest":{"function_hash":"980879606116961424568499125119397203","length":2376},"id":"CVE-2026-34789-ba0c75de","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"235633813084253699391269729123140217442","length":673},"id":"CVE-2026-34789-ce83f612","signature_type":"Function","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/983037f3003dc31f48db36705b86fb3fbe026295","target":{"file":"src/App/PropertyPythonObject.cpp","function":"PropertyPythonObject::loadPickle"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}