CVE-2026-73233: FreeCAD FEM Dialog RCE Vulnerability

CVE-2026-73233 Overview

CVE-2026-73233 is a code injection vulnerability [CWE-94] in FreeCAD, the open-source multiplatform 3D parametric modeler. The flaw resides in the FEM Displacement Constraint task dialog implemented in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp. The xDisplacementFormula, yDisplacementFormula, and zDisplacementFormula fields flow through TaskDlgFemConstraintDisplacement::accept() into Gui::Command::doCommand. The escaping helper neutralizes quotation marks but not backslashes, letting crafted formula text break out of the generated Python string. When a victim accepts the dialog, arbitrary Python code executes with the FreeCAD process's privileges. The issue is fixed in version 1.1.2.

Critical Impact
Attackers can achieve arbitrary Python code execution with FreeCAD process privileges when a victim opens a malicious model and accepts the FEM Displacement Constraint dialog.

Affected Products

FreeCAD versions prior to 1.1.2
FreeCAD FEM module (src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp)
All platforms where FreeCAD runs (Windows, macOS, Linux)

Discovery Timeline

2026-08-11 - CVE-2026-73233 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73233

Vulnerability Analysis

The vulnerability stems from incomplete input sanitization in the FreeCAD FEM workbench. The get_xFormula(), get_yFormula(), and get_zFormula() helper functions escape double-quote characters by prefixing them with a backslash. They do not escape backslash characters themselves. When the resulting formula strings are interpolated into a Python command via Gui::Command::doCommand, an attacker-supplied trailing backslash cancels the escaping of the following double quote. This terminates the generated Python string literal early and allows subsequent characters to be interpreted as Python code.

Exploitation requires a victim to open a crafted FreeCAD model containing a Fem::ConstraintDisplacement object with malicious formula fields and to accept the displacement constraint dialog. Successful exploitation yields arbitrary Python execution with the same privileges as the FreeCAD process.

Root Cause

The root cause is improper neutralization of special elements used in a code statement [CWE-94]. Escaping quotation marks without escaping backslashes leaves the quoting boundary vulnerable to a classic string-breakout pattern of the form \"; <python code>; #.

Attack Vector

The attack vector is local and requires user interaction. An attacker distributes a malicious .FCStd project file. Upon opening the file and interacting with the FEM Displacement Constraint dialog, the crafted formula strings are passed to the Python command generator, and injected code executes.

cpp

// Security patch: src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp
// The vulnerable escaping helpers were removed in favor of direct C++ text
// assignment, eliminating the Python string interpolation entirely.

std::string TaskFemConstraintDisplacement::get_xFormula() const
{
-    QString xFormula = ui->DisplacementXFormulaLE->text();
-    xFormula.replace(QStringLiteral("\""), QStringLiteral("\\\""));
-    return xFormula.toStdString();
+    return ui->DisplacementXFormulaLE->text().toStdString();
}

std::string TaskFemConstraintDisplacement::get_yFormula() const
{
-    QString yFormula = ui->DisplacementYFormulaLE->text();
-    yFormula.replace(QStringLiteral("\""), QStringLiteral("\\\""));
-    return yFormula.toStdString();
+    return ui->DisplacementYFormulaLE->text().toStdString();
}

std::string TaskFemConstraintDisplacement::get_zFormula() const
{
-    QString zFormula = ui->DisplacementZFormulaLE->text();
-    zFormula.replace(QStringLiteral("\""), QStringLiteral("\\\""));
-    return zFormula.toStdString();
+    return ui->DisplacementZFormulaLE->text().toStdString();
}

Source: GitHub Commit 0a208ac

Detection Methods for CVE-2026-73233

Indicators of Compromise

FreeCAD project files (.FCStd) containing Fem::ConstraintDisplacement objects whose xDisplacementFormula, yDisplacementFormula, or zDisplacementFormula fields contain trailing backslash sequences preceding quotation marks
Unexpected child processes spawned by the FreeCAD binary after a user opens a shared model
Outbound network connections initiated by the FreeCAD process shortly after opening a .FCStd file

Detection Strategies

Inspect .FCStd archives (they are ZIP containers) for Document.xml entries containing displacement formula properties with backslash-quote patterns such as \"
Monitor endpoint telemetry for FreeCAD spawning shells, python, or LOLBins such as powershell.exe, cmd.exe, or /bin/sh
Alert on file writes or registry changes made by the FreeCAD process outside expected model directories

Monitoring Recommendations

Enforce software inventory checks to identify FreeCAD installations below version 1.1.2
Log process creation events with parent-child relationships to catch anomalous FreeCAD descendants
Correlate opens of externally sourced .FCStd files with subsequent process or network activity

How to Mitigate CVE-2026-73233

Immediate Actions Required

Upgrade FreeCAD to version 1.1.2 or later on all workstations
Do not open FreeCAD models received from untrusted sources until upgrade is complete
Review shared model repositories for Fem::ConstraintDisplacement objects with suspicious formula content

Patch Information

The fix is included in GitHub Release 1.1.2 and consists of commits 0a208ac and 3f60d20, delivered via Pull Request #31267 and Pull Request #31312. The patch removes Python string interpolation for formula fields and instead sets values directly via C++, eliminating the injection sink. Full details are in GitHub Security Advisory GHSA-2rq3-gx3h-489q.

Workarounds

Avoid opening FreeCAD project files from untrusted origins until version 1.1.2 is installed
Refrain from accepting the FEM Displacement Constraint task dialog on unfamiliar models
Run FreeCAD under a least-privilege user account to limit impact of successful exploitation

bash

# Verify installed FreeCAD version and upgrade
freecad --version

# Debian/Ubuntu example (once distribution package is updated)
sudo apt update && sudo apt install --only-upgrade freecad

# Or fetch the fixed release directly
# https://github.com/FreeCAD/FreeCAD/releases/tag/1.1.2