Autodesk Fusion XSS Flaw Lets Attackers Steal Local Files

A critical Stored Cross-Site Scripting (XSS) vulnerability has been identified in Autodesk Fusion desktop application, as reported by the National Vulnerability Database. The flaw, tracked as CVE-2026-4344, allows a remote attacker to execute code or read local files by tricking a user into clicking a maliciously crafted HTML payload within a component name. This payload, when displayed during a delete confirmation dialog, triggers the vulnerability.

The National Vulnerability Database rates this flaw with a CVSS score of 7.1 (HIGH). While the specific affected products are not detailed, the vulnerability stems from improper handling of HTML input in component names, leading to CWE-79 (Improper Neutralization of Input During Web Page Generation). This is a classic example of how seemingly minor UI elements can become vectors for serious attacks if not properly sanitized.