CVE-2026-73233

CVE-2026-73233 is a context-blinding vulnerability in FreeCAD's FEM constraint dialog. The issue lies in a helper function that wraps user input for Python execution via doCommand(). The developer implemented quote escaping—correctly identifying that untrusted input in a command-execution path needed boundary enforcement. What was missed: backslashes. The C++ code escapes quotes, but the sanitized string feeds into Python's string parser. In Python, backslashes before quotes and other characters create escape sequences that break out of the intended string literal, allowing arbitrary Python code injection after the C++-level escaping has already been applied. The attacker doesn't bypass the quoting; they escape through it using the backslash character that C++ treats as literal but Python interprets as an escape introducer. This is the fundamental failure: the developer modeled one parsing layer (C++) and applied the canonical SQL-injection defense (quote escaping) without accounting for the downstream interpreter (Python) that consumes the output. The domain context—FEM engineers writing mathematical formulas—likely contributed to implicit trust in the input, since backslashes are syntactically meaningful in formula notation. The fix adds backslash handling to the same helper function. For defenders: audit every call site that passes user input to doCommand() or equivalent dynamic execution APIs. The existence of a centralized escaping helper creates a blast radius risk—one developer's partial sanitization may be implicitly trusted across many call sites. Treat any GUI dialog accept() handler that routes to command execution as a mandatory security review trigger. The specific pattern to hunt: quote-escaping without backslash-handling in any code path that produces strings for interpretation by another language runtime.

Reviewed through automated stages and approved by a human before publication.