Executive brief
PrusaSlicer is a popular 3D printing tool used to convert 3D models into instructions for a printer. A security flaw allows a malicious 3D project file (.3mf) to automatically run unauthorized commands on a user's computer when they attempt to prepare the file for printing. This could lead to a full system compromise, data theft, or the installation of malware if a user opens and processes a file from an untrusted source.
Technical details
A command injection vulnerability exists in libslic3r/GCode/PostProcessor.cpp within PrusaSlicer through version 2.6.1. The software fails to properly neutralize special elements in the 'post_process' metadata field within the 'Metadata/Slic3r_PE.config' file of a 3mf (ZIP) archive. When a user slices a model or exports G-code from a malicious project file, the application executes the string provided in the post-processing script setting. An attacker can exploit this by distributing a crafted 3mf file that, when opened and processed by a victim, executes arbitrary shell commands with the privileges of the user. This can be triggered via the GUI during export or via the command-line interface using the '-s' flag.
Affected products
- Prusa Research PrusaSlicer through 2.6.1
Timeline
- 2023-11-06: disclosed: CVE assigned
- 2024-04-12: other: Exploit proof-of-concept published by Kamil Breński
- 2026-05-08: advisory: NVD publication date