librecad is vulnerable to remote code execution. The vulnerability exists due to a heap buffer overflow in DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib allowing an attacker to inject maliciously crafted script into the system via a specially-crafted .dxf file.
lists.debian.org/debian-lts-announce/2022/06/msg00008.html
lists.fedoraproject.org/archives/list/[email protected]/message/5BUOTYU3KKIYE4BEBUFA4MRS462P3OWM/
lists.fedoraproject.org/archives/list/[email protected]/message/DA4C4X5GMM65VYLUW7Q7YL6P5NDB633A/
lists.fedoraproject.org/archives/list/[email protected]/message/IMGMEPTYL7WTQ333J6SMC6MUHDMMWT3O/
lists.fedoraproject.org/archives/list/[email protected]/message/L2H36XRMAPQBIOVIIFX6KUT5YOG2ETM6/
security-tracker.debian.org/tracker/CVE-2021-21897
talosintelligence.com/vulnerability_reports/TALOS-2021-1346