Autodesk Fusion XSS: Local File Read, Code Execution Risk

The National Vulnerability Database (NVD) has flagged CVE-2026-4369, a high-severity Stored Cross-site Scripting (XSS) vulnerability impacting the Autodesk Fusion desktop application. This isn’t your run-of-the-mill XSS; it’s got teeth, potentially allowing an attacker to read local files or even execute arbitrary code on the affected system.

The exploit hinges on a maliciously crafted HTML payload embedded in an assembly variant name. When this name is displayed within a delete confirmation dialog and subsequently clicked by a user, it triggers the XSS. The NVD assigned a CVSS score of 7.1 (High), underscoring the serious implications, particularly the confidentiality and integrity impacts (C:H/I:H). While specific affected product versions weren’t detailed by the NVD, the CWE-79 classification points directly to an improper neutralization of input during web page generation, a classic XSS scenario.