{"id":"CVE-2026-102636","kind":"vulnerability","aliases":["CVE-2026-102636"],"related":[],"title":"Autodesk Fusion: HTML in a design name runs script and reads local files","description":"A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.","summary":"A design name containing crafted HTML is stored and then executed as script when another user opens the design in the Autodesk Fusion desktop application. An attacker can read local files or run arbitrary code in the context of the running Fusion process.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["autodesk-fusion","design-teams","desktop","other"],"not_affected_if":["no-shared-designs","web-only-use"],"how_to_check":"- Confirm the installed Autodesk Fusion desktop version in the application's About dialog or software manager; the sources do not list affected version numbers.\n- Review shared Fusion designs from untrusted collaborators for unusual design names containing HTML tags.","fix":"- Update Autodesk Fusion to the latest release from Autodesk; the sources do not name a fixed version.\n- Avoid opening designs shared by untrusted users until the update is applied.","status":"open","published_at":"2026-10-27T17:16:54+00:00","first_seen_at":"2026-10-27T17:32:44+00:00","triaged_at":"2026-10-27T17:34:45+00:00","updated_at":"2026-10-27T17:34:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T17:34:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update Autodesk Fusion to the latest release from Autodesk; the sources do not name a fixed version.\n- Avoid opening designs shared by untrusted users until the update is applied.","reach":"unknown","title":"Autodesk Fusion: HTML in a design name runs script and reads local files","impact":"high","summary":"A design name containing crafted HTML is stored and then executed as script when another user opens the design in the Autodesk Fusion desktop application. An attacker can read local files or run arbitrary code in the context of the running Fusion process.","category":"other","nicknames":[],"who_cares":["autodesk-fusion","desktop","design-teams"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads local files or runs code as the logged-in user","analyst_note":"Check the Autodesk security bulletin for affected and fixed Fusion versions and whether the sources' CVSS 7.1 matches the vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-102636","how_to_check":"- Confirm the installed Autodesk Fusion desktop version in the application's About dialog or software manager; the sources do not list affected version numbers.\n- Review shared Fusion designs from untrusted collaborators for unusual design names containing HTML tags.","needs_analyst":true,"not_affected_if":["no-shared-designs","web-only-use"],"who_is_affected":"Teams that use the Autodesk Fusion desktop application and open designs shared by other users, especially across collaborators or external partners, are exposed. Users who only work on their own designs and never open shared ones are less exposed; the sources do not say more.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":3328,"output_tokens":610,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102636':16A,19A '-2026':15A,18A 'actor':106C 'anoth':41B,82C 'applic':51B,103C 'arbitrari':60B,117C 'attack':53B 'autodesk':1A,21B,48B,100C 'autodesk-fus':20B 'code':61B,118C 'contain':30B 'context':64B,121C 'craft':31B,72C 'cross':93C 'cross-sit':92C 'current':124C 'cve':14A,17A 'design':6A,24B,28B,45B,77C,87C 'design-team':23B 'desktop':26B,50B,102C 'display':80C 'execut':37B,116C 'file':13A,57B,114C 'fusion':2A,22B,49B,68B,101C 'html':3A,32B,73C 'leverag':108C 'local':12A,56B,113C 'malici':71C,105C 'manipul':86C 'may':107C 'name':7A,29B,78C 'open':43B,84C 'payload':74C 'process':69B,125C 'read':11A,55B,112C 'run':8A,59B,67B 'script':9A,39B,95C 'site':94C 'store':34B,91C 'team':25B 'trigger':89C 'user':42B,83C 'vulner':97C,110C 'xss':96C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the Autodesk Fusion desktop application and open designs shared by other users, especially across collaborators or external partners, are exposed. Users who only work on their own designs and never open shared ones are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"psirt@autodesk.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102636","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102636","severity":null,"published_at":"2026-10-27T17:16:54+00:00","modified_at":"2026-10-27T17:16:54+00:00","first_seen_at":"2026-10-27T17:32:44+00:00","fetched_at":"2026-10-27T17:32:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}