The vulnerability occurs when the BIM Project Manager processes metadata from an imported BIM project file, passing attacker‑controlled values to Python’s eval() function. Exploiting this flaw allows the execution of arbitrary Python code during file loading, giving an attacker the ability to run malicious code with the same privileges as the application. This weakness is identified as CWE‑94 and CWE‑95 and threatens the confidentiality, integrity, and availability of affected systems.

All FreeCAD releases from 0.19 up to and including 1.1.1 contain the affected code in src/Mod/BIM/bimcommands/BimProjectManager.py. The security fix was applied in version 1.1.1, which removes the eval() call on untrusted metadata. Therefore, any installation running a version prior to 1.1.1 is vulnerable.

The CVSS score of 7.8 indicates medium‑high severity, and the EPSS score is not available, so the current probability of exploitation is unknown but may be significant because the attacker only needs to supply a malicious BIM file. The vulnerability is not listed in the CISA KEV catalog, but the impact of arbitrary code execution remains severe, especially if malicious templates are distributed through the supply chain or shared files. Prompt remediation is recommended.