PrusaSlicer is a 3D printing slicing application that converts 3D model files into G‑code. A flaw in the PostProcessor component allows an attacker to embed malicious commands within a crafted 3mf project file. When a user loads such a file and exports or previews G‑code, the application inadvertently executes arbitrary code with the privileges of the user running PrusaSlicer. The impact, therefore, is that a local attacker can run any code, potentially installing malware, exfiltrating data or gaining full control of the host. Based on the description, the attack is inferred to be local, requiring the attacker to supply a malicious 3mf file to a system that regularly opens such files for slicing.

PrusaSlicer versions up to 2.6.1 on Windows, macOS, and Linux.

The vulnerability enables unrestricted local code execution, giving the attacker full control over the affected system. The CVSS score is 5.3, the EPSS score is <1%, and there is no KEV listing. The potential impact still makes this issue a top priority. The likely attack vector is a local attacker who can supply a malicious 3mf file to a system that routinely opens such files for slicing.