The web app allows rapid 3D design iteration and support for CAD formats.
Because attacker-supplied flow data is used in public flows, the bug leads to unauthenticated remote code execution.