What is CVE-2026-34789?
CVE-2026-34789 is a critical vulnerability in FreeCAD versions prior to 1.1.2, where the `PropertyPythonObject::Restore()` function passes attacker-controlled module attributes from serialized XML directly to `PyImport_ImportModule()`. This allows arbitrary Python module import and code execution via a crafted file. Immediate update to version 1.1.2 or later is strongly recommended.
Azərbaycanca: CVE-2026-34789, FreeCAD-in 1.1.2 versiyasından əvvəlki versiyalarında PropertyPythonObject::Restore() funksiyasında aşkar edilmiş kritik boşluqdur. Təcavüzkar xüsusi hazırlanmış XML faylı vasitəsilə `PyImport_ImportModule()` funksiyasına nəzarət edərək ixtiyari Python modulunu yükləyə və kod icrası həyata keçirə bilər. Dərhal 1.1.2 və ya daha yuxarı versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-94
FAQ2
Which versions of FreeCAD are affected by CVE-2026-34789?
This vulnerability affects all versions of FreeCAD prior to 1.1.2.
How can an attacker achieve arbitrary code execution through this vulnerability?
An attacker can load an arbitrary Python module by passing crafted module attributes from an XML file directly to `PyImport_ImportModule()` via the `PropertyPythonObject::Restore()` function.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.