This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-34789 →

DEBIAN-CVE-2026-34789

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Resto...

Original description

The description as published by the source.

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore() passes the attacker-controlled module attribute from serialized PropertyPythonObject XML directly to PyImport_ImportModule() while restoring a crafted FCStd document, which executes module-level Python code, and the legacy pickle branch also imports an attacker-controlled module and invokes its class constructor through PyObject_CallObject(). This issue is fixed in version 1.1.2.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 freecad

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2+dfsg1-4+deb12u1"}]}]

Debian:13 freecad

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0+dfsg-8+deb13u3"}]}]

Debian:14 freecad

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3+dfsg-1"}]}]

References

advisory security-tracker.debian.org