CVE-2026-102636: Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the Autodesk Fusion desktop application are exposed when they open a design whose name has been manipulated to contain a malicious HTML payload. The payload is triggered when the crafted design name is displayed in the application.
What does an attacker need to exploit it?
The attacker needs to create or manipulate a design name to include a malicious HTML payload and have another user open the manipulated design. No privileges are required, but user interaction is required because the target must open the design.
What could successful exploitation allow?
Successful exploitation may allow the attacker to read local files or execute arbitrary code in the context of the current Autodesk Fusion process. The vulnerability does not claim impact outside that process context.
What can be done while a fix is being applied?
Avoid opening designs from untrusted or unexpected sources, particularly where the design name may have been altered. Treat suspicious design names as potentially malicious until the relevant Autodesk security advisory has been reviewed and remediation applied.