{"id":"CVE-2026-102637","kind":"vulnerability","aliases":["CVE-2026-102637"],"related":[],"title":"Autodesk Fusion: crafted Fusion URL in documentName runs script locally","description":"A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.","summary":"A crafted HTML payload in the documentName parameter of a Fusion protocol URL triggers reflected cross-site scripting in the Autodesk Fusion desktop app. An attacker can read local files or execute code in the context of the running process.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["autodesk-fusion","desktop","macos","package","windows"],"not_affected_if":["no-fusion-desktop-install"],"how_to_check":"- Check the installed Autodesk Fusion version in the app's About dialog; the affected version range is unknown from the sources.\n- Review whether Fusion protocol links are opened from untrusted email or web pages: unknown from the sources.","fix":"- Update Autodesk Fusion to the patched release from Autodesk; the fixed version is unknown from the sources.","status":"open","published_at":"2026-10-27T17:16:55+00:00","first_seen_at":"2026-10-27T17:32:44+00:00","triaged_at":"2026-10-27T17:34:44+00:00","updated_at":"2026-10-27T17:34:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T17:34:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update Autodesk Fusion to the patched release from Autodesk; the fixed version is unknown from the sources.","reach":"local","title":"Autodesk Fusion: crafted Fusion URL in documentName runs script locally","impact":"high","summary":"A crafted HTML payload in the documentName parameter of a Fusion protocol URL triggers reflected cross-site scripting in the Autodesk Fusion desktop app. An attacker can read local files or execute code in the context of the running process.","category":"package","nicknames":[],"who_cares":["autodesk-fusion","desktop","windows","macos"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads local files or runs code in the Fusion process.","analyst_note":"Check Autodesk's security bulletin for affected and fixed Fusion versions and the platforms involved; the NVD entry alone does not give them.","how_to_check":"- Check the installed Autodesk Fusion version in the app's About dialog; the affected version range is unknown from the sources.\n- Review whether Fusion protocol links are opened from untrusted email or web pages: unknown from the sources.","needs_analyst":true,"not_affected_if":["no-fusion-desktop-install"],"who_is_affected":"Teams whose staff use the Autodesk Fusion desktop application on workstations, especially where users follow Fusion protocol links from email or web content. The sources do not say which Fusion versions or platforms are affected. Users who never open Fusion protocol URLs are less exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000616,"input_tokens":3350,"output_tokens":562,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102637':13A,16A '-2026':12A,15A 'actor':106C 'app':48B 'applic':103C 'arbitrari':117C 'attack':50B 'autodesk':1A,18B,45B,100C 'autodesk-fus':17B 'code':57B,118C 'context':60B,121C 'craft':3A,25B,67C 'cross':40B,93C 'cross-sit':39B,92C 'current':124C 'cve':11A,14A 'desktop':20B,47B,102C 'documentnam':7A,30B,72C 'execut':56B,116C 'file':54B,114C 'fusion':2A,4A,19B,34B,46B,76C,101C 'html':26B,68C 'invok':84C 'leverag':108C 'local':10A,53B,113C 'maco':21B 'malici':66C,105C 'may':107C 'packag':22B 'paramet':31B,73C 'payload':27B,69C 'process':64B,125C 'protocol':35B,77C,81C 'read':52B,112C 'reflect':38B,91C 'run':8A,63B 'script':9A,42B,95C 'site':41B,94C 'trigger':37B,89C 'url':5A,36B,78C,82C 'user':87C 'vulner':97C,110C 'window':23B 'xss':96C","nicknames":[],"mitigations":[],"who_affected":"Teams whose staff use the Autodesk Fusion desktop application on workstations, especially where users follow Fusion protocol links from email or web content. The sources do not say which Fusion versions or platforms are affected. Users who never open Fusion protocol URLs are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"psirt@autodesk.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102637","severity":null,"published_at":"2026-10-27T17:16:55+00:00","modified_at":"2026-10-27T17:16:55+00:00","first_seen_at":"2026-10-27T17:32:44+00:00","fetched_at":"2026-10-27T17:32:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}