Live › vulnerability › CVE-2026-102636
Go to dashboardA design name containing crafted HTML is stored and then executed as script when another user opens the design in the Autodesk Fusion desktop application. An attacker can read local files or run arbitrary code in the context of the running Fusion process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Teams that use the Autodesk Fusion desktop application and open designs shared by other users, especially across collaborators or external partners, are exposed. Users who only work on their own designs and never open shared ones are less exposed; the sources do not say more.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
This page as .md · .json · in your agent: get_signal("CVE-2026-102636")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.