Live › vulnerability › CVE-2026-107672
Go to dashboardA maliciously crafted .stack.json file can trigger a Markdown injection flaw in the Autodesk Fusion Post Processor Utility Extension. An attacker who gets a user to open such a file can run arbitrary commands as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:33 UTC. All times on this page are UTC.
Teams that edit Fusion/Inventor CAM/HSMWorks post processors in VS Code with the Autodesk Fusion Post Processor Utility extension and open .stack.json files from outside sources. Affected versions and fixed version are not published in any source I could read. Anyone who does not have this extension installed can skip it.
No product ranges from the sources yet.
Autodesk Fusion Post Processor Utility (Autodesk.hsm-post-processor) version in the Extensions panel, and update it to the latest; avoid opening untrusted .stack.json files meanwhileUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user.
This page as .md · .json · in your agent: get_signal("CVE-2026-107672")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.