Autodesk Fusion XSS Flaw Puts Local Files, Code at Risk

The National Vulnerability Database (NVD) has documented a high-severity Stored Cross-site Scripting (XSS) vulnerability, identified as CVE-2026-4345, affecting the Autodesk Fusion desktop application. This isn’t just a simple client-side annoyance; a maliciously crafted HTML payload, when stored in a design name and subsequently exported to CSV, can trigger this nasty flaw.

According to the NVD, the impact is significant. A threat actor could leverage this vulnerability to read local files on an affected system or even execute arbitrary code. The CVSS score of 7.1 (HIGH) reflects the potential for serious damage, especially given the ‘High’ confidentiality and integrity impacts noted in the CVSS vector. While specific affected product versions weren’t detailed by the NVD, the underlying issue is categorized under CWE-79, a well-known weakness for improper neutralization of input during web page generation, commonly leading to XSS.