{"id":"CVE-2026-73233","summary":"FreeCAD: FEM formula incomplete escape","details":"FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields of a Fem::ConstraintDisplacement object through TaskDlgFemConstraintDisplacement::accept() into Gui::Command::doCommand. The escaping helper neutralizes quotation marks but not backslashes, allowing crafted formula text to terminate the generated Python string and execute arbitrary Python code with the FreeCAD process's privileges when a victim accepts the dialog. This issue is fixed in version 1.1.2.","aliases":["GHSA-2rq3-gx3h-489q"],"modified":"2026-08-13T08:22:37.237472Z","published":"2026-08-11T19:39:18.878Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73233.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73233.json"},{"type":"ADVISORY","url":"https://github.com/FreeCAD/FreeCAD/security/advisories/GHSA-2rq3-gx3h-489q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73233"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/commit/3f60d202a8246958232e2fbc74ba38a83483b74e"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/pull/31267"},{"type":"FIX","url":"https://github.com/FreeCAD/FreeCAD/pull/31312"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freecad/freecad","events":[{"introduced":"0"},{"fixed":"0a208ac11cfe7b61c424ee4bb79117138ec50ac2"},{"fixed":"3f60d202a8246958232e2fbc74ba38a83483b74e"},{"fixed":"6c24c1ac45f312fc6b604a076ea4cb0664d0c5ca"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.1.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["weekly-2026.07.09","weekly-2026.07.08","weekly-2026.07.01","weekly-2026.06.24","weekly-2026.06.20","weekly-2026.06.17","weekly-2026.06.10","weekly-2026.06.03","weekly-2026.05.27","weekly-2026.05.20","weekly-2026.05.13","weekly-2026.05.06","weekly-2026.04.29","weekly-2026.04.22","1.1.1","weekly-2026.04.15","weekly-2026.04.08","weekly-2026.04.01","1.1.0","weekly-2026.03.25","weekly-2026.03.19","weekly-2026.03.18","weekly-2026.03.11","weekly-2026.03.04","weekly-2026.02.25","1.1rc3","weekly-2026.02.18","weekly-2026.02.11","weekly-2026.02.04","weekly-2026.01.28","weekly-2026.01.21","weekly-2026.01.14","1.1rc2","weekly-2026.01.07","weekly-2025.12.31","weekly-2025.12.24","weekly-2025.12.17","weekly-2025.12.10","weekly-2025.12.03","1.1rc1","weekly-2025.11.26","weeklies","weekly-2025.11.20","weekly-2025.11.19","weekly-2025.11.12","weekly-2025.11.05","weekly-2025.11.02","weekly-2025.10.31","weekly-2025.10.29","weekly-2025.10.22","weekly-2025.10.15","weekly-2025.10.08","weekly-2025.10.01","weekly-2025.09.24","weekly-2025.09.17","weekly-2025.09.12","weekly-2025.09.11","weekly-2025.09.10","weekly-2025.09.03","weekly-2025.08.27","weekly-2025.08.20","weekly-2025.08.13","weekly-2025.08.07","weekly-2025.08.05","weekly-2025.08.04","weekly-2025.07.29","weekly-2025.07.28","weekly-2025.07.26","weekly-2025.07.25","weekly-2025.07.24","weekly-2025.07.21","weekly-2025.07.14","weekly-2025.07.07","weekly-2025.06.30","weekly-2025.06.23","weekly-2025.06.16","weekly-2025.06.09","weekly-2025.06.02","weekly-2025.05.26","weekly-2025.05.19","weekly-2025.05.13","weekly-2025.05.02","weekly-2025.05.06","weekly-2025.04.28","weekly-2025.04.21","0.21rc1","0.20","0.20beta1","0.19","0.18","0.17","0.16"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73233.json","vanir_signatures_modified":"2026-08-13T08:22:37Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"47164409946150314680252035528740718596","length":211},"id":"CVE-2026-73233-0216c967","signature_type":"Function","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/3f60d202a8246958232e2fbc74ba38a83483b74e","target":{"file":"src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp","function":"TaskFemConstraintDisplacement::get_zFormula"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2","target":{"file":"src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp","function":"TaskFemConstraintDisplacement::get_xFormula"},"deprecated":false,"digest":{"function_hash":"64536510101029784594228892017303047186","length":211},"id":"CVE-2026-73233-17e7b5f5"},{"deprecated":false,"digest":{"line_hashes":["16826431145685571219371598828065718238","334043939218090023240239896255968243571","316724852219187604541157205219040568760","197061554422943313784577392852192140518","113965561451132691077314053143545651492","113640793144273273484852106971355560207","274439315539132509782613530185042835557","69123972941178959368202034881197131099","151828067484224822511975716674129792033","201284739759920415900622179692241403567","306422005215372994276858813954565602723","2325329105120534399570503103789911783","124015121660598509649858018028271465133","231689212295386517567949091962986622973","5664896645272095285779521242832913111","189579331602150683556751400034308365702","210165482214754522181515740998778386684","137625710512793870282701650149773284278","176001207364684447550154701307522909288","233904271071411162304304987614275895280","263934275140333912481874166760656151575","244669200224009138053592417700229054256","238727820857656323838948279114396647660","8614998481704984679520498233598844866","46967662710907570884985073545800888589","330231792408658375408382470804827995266","151079188274287120629038865074459641118","253311176559472984037847214209294412207","307014652790761659973079177851991741213","123691191129875177431813018841491477399","211188143592892953828177738906042466585","113961774073909967725803021795428664031","228367316088377723838020164217023115560","3052150626654764906187701966410445497","332346956157487683629587668153218668959","75014136193367837601771270110793926798","234947439865864263076415498940063751382","22174365016396067312340224066939615957","117412950304319881478739195716298653120","180179562221460177175640679683228436241","269788142334228939543824332737282659715","73100434282079456735953348744349706359","340030429199716890712418865143992254850","4116965526720839899227214937112943701","328908249169225979957037299032335073852","126741051060917948831311247304892822320","137136457041905515807528027290632845861","48373916897326314131957971149273806120","173900746943072217053735684333074200064","232926785559247213835004192765833768668","228367823810323386602708245227751254526","157900957520970444572718797792291101090","310699903826449619667691662023379488702","107004575713073288642033466027567556805","274543631658162189308139840818889068974"],"threshold":0.9},"id":"CVE-2026-73233-5ae7b00d","signature_type":"Line","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/3f60d202a8246958232e2fbc74ba38a83483b74e","target":{"file":"src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp"}},{"source":"https://github.com/freecad/freecad/commit/3f60d202a8246958232e2fbc74ba38a83483b74e","target":{"file":"src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp","function":"TaskDlgFemConstraintDisplacement::accept"},"deprecated":false,"digest":{"function_hash":"329334325353723419533405325253199596580","length":3535},"id":"CVE-2026-73233-783b1428","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"47164409946150314680252035528740718596","length":211},"id":"CVE-2026-73233-958a8174","signature_type":"Function","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2","target":{"file":"src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp","function":"TaskFemConstraintDisplacement::get_zFormula"}},{"target":{"file":"src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp"},"deprecated":false,"digest":{"line_hashes":["16826431145685571219371598828065718238","334043939218090023240239896255968243571","316724852219187604541157205219040568760","197061554422943313784577392852192140518","113965561451132691077314053143545651492","113640793144273273484852106971355560207","274439315539132509782613530185042835557","69123972941178959368202034881197131099","151828067484224822511975716674129792033","201284739759920415900622179692241403567","306422005215372994276858813954565602723","2325329105120534399570503103789911783","124015121660598509649858018028271465133","231689212295386517567949091962986622973","5664896645272095285779521242832913111","189579331602150683556751400034308365702","210165482214754522181515740998778386684","137625710512793870282701650149773284278","176001207364684447550154701307522909288","233904271071411162304304987614275895280","263934275140333912481874166760656151575","244669200224009138053592417700229054256","238727820857656323838948279114396647660","8614998481704984679520498233598844866","46967662710907570884985073545800888589","330231792408658375408382470804827995266","151079188274287120629038865074459641118","253311176559472984037847214209294412207","307014652790761659973079177851991741213","123691191129875177431813018841491477399","211188143592892953828177738906042466585","113961774073909967725803021795428664031","228367316088377723838020164217023115560","3052150626654764906187701966410445497","332346956157487683629587668153218668959","75014136193367837601771270110793926798","234947439865864263076415498940063751382","22174365016396067312340224066939615957","117412950304319881478739195716298653120","180179562221460177175640679683228436241","269788142334228939543824332737282659715","73100434282079456735953348744349706359","340030429199716890712418865143992254850","4116965526720839899227214937112943701","328908249169225979957037299032335073852","126741051060917948831311247304892822320","137136457041905515807528027290632845861","48373916897326314131957971149273806120","173900746943072217053735684333074200064","232926785559247213835004192765833768668","228367823810323386602708245227751254526","157900957520970444572718797792291101090","310699903826449619667691662023379488702","107004575713073288642033466027567556805","274543631658162189308139840818889068974"],"threshold":0.9},"id":"CVE-2026-73233-d667366c","signature_type":"Line","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2"},{"source":"https://github.com/freecad/freecad/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2","target":{"file":"src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp","function":"TaskDlgFemConstraintDisplacement::accept"},"deprecated":false,"digest":{"function_hash":"329334325353723419533405325253199596580","length":3535},"id":"CVE-2026-73233-e1070419","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"324856218144965389178695870855796351392","length":211},"id":"CVE-2026-73233-f22fafa6","signature_type":"Function","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/0a208ac11cfe7b61c424ee4bb79117138ec50ac2","target":{"file":"src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp","function":"TaskFemConstraintDisplacement::get_yFormula"}},{"target":{"file":"src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp","function":"TaskFemConstraintDisplacement::get_yFormula"},"deprecated":false,"digest":{"function_hash":"324856218144965389178695870855796351392","length":211},"id":"CVE-2026-73233-f37c4887","signature_type":"Function","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/3f60d202a8246958232e2fbc74ba38a83483b74e"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/freecad/freecad/commit/3f60d202a8246958232e2fbc74ba38a83483b74e","target":{"file":"src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp","function":"TaskFemConstraintDisplacement::get_xFormula"},"deprecated":false,"digest":{"function_hash":"64536510101029784594228892017303047186","length":211},"id":"CVE-2026-73233-f77e3895"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}