---
id: "CVE-2026-102636"
kind: "vulnerability"
aliases: ["CVE-2026-102636"]
title: "Autodesk Fusion: HTML in a design name runs script and reads local files"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["autodesk-fusion", "design-teams", "desktop", "other"]
not_affected_if: ["no-shared-designs", "web-only-use"]
published_at: "2026-10-27T17:16:54+00:00"
first_seen_at: "2026-10-27T17:32:44+00:00"
updated_at: "2026-10-27T17:34:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102636", "first_seen_at": "2026-10-27T17:32:44+00:00"}]
---

# Autodesk Fusion: HTML in a design name runs script and reads local files

A design name containing crafted HTML is stored and then executed as script when another user opens the design in the Autodesk Fusion desktop application. An attacker can read local files or run arbitrary code in the context of the running Fusion process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed Autodesk Fusion desktop version in the application's About dialog or software manager; the sources do not list affected version numbers.
- Review shared Fusion designs from untrusted collaborators for unusual design names containing HTML tags.

## Fix

- Update Autodesk Fusion to the latest release from Autodesk; the sources do not name a fixed version.
- Avoid opening designs shared by untrusted users until the update is applied.

## Timeline

- 2026-10-27T17:32:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102636

## From the sources

A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_