{"id":"CVE-2026-107672","kind":"vulnerability","aliases":["CVE-2026-107672"],"related":[],"title":"Autodesk Fusion: crafted .stack.json file runs commands as current user","description":"A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user.","summary":"A maliciously crafted .stack.json file can trigger a Markdown injection flaw in the Autodesk Fusion Post Processor Utility Extension. An attacker who gets a user to open such a file can run arbitrary commands as that user.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["autodesk-fusion","cad","desktop","other","vscode-extension"],"not_affected_if":["no-post-processor-extension"],"how_to_check":"Unknown until Autodesk publishes. Check the installed VS Code extension 'Autodesk Fusion Post Processor Utility' (Autodesk.hsm-post-processor) version in the Extensions panel, and update it to the latest; avoid opening untrusted .stack.json files meanwhile.","fix":null,"status":"open","published_at":"2026-10-27T16:17:29+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","triaged_at":"2026-10-27T16:34:03+00:00","updated_at":"2026-10-27T16:36:47+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T16:34:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Autodesk Fusion: crafted .stack.json file runs commands as current user","impact":"high","summary":"A maliciously crafted .stack.json file can trigger a Markdown injection flaw in the Autodesk Fusion Post Processor Utility Extension. An attacker who gets a user to open such a file can run arbitrary commands as that user.","category":"other","nicknames":[],"who_cares":["autodesk-fusion","cad","desktop"],"confidence":0.5,"needs_auth":"no","worst_case":"Arbitrary commands run as the current user on the workstation.","analyst_note":"Find the Autodesk advisory for affected Fusion Post Processor versions and the patched build; the NVD entry alone gives no version or fix.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-post-processor-extension"],"who_is_affected":"Teams that use Autodesk Fusion with the Post Processor Utility Extension and open .stack.json files from outside sources. The sources do not name affected versions or say whether other configurations are exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000543,"input_tokens":3312,"output_tokens":423,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Autodesk advisory for affected Fusion Post Processor versions and the patched build; the NVD entry alone gives no version or fix.","search":"'-107672':13A,16A '-2026':12A,15A 'actor':84C 'arbitrari':58B,91C 'attack':46B 'autodesk':1A,18B,39B,76C 'autodesk-fus':17B 'cad':20B 'command':7A,59B,92C 'context':95C 'craft':3A,28B,65C 'current':9A,98C 'cve':11A,14A 'desktop':21B 'execut':90C 'exploit':86C 'extens':25B,44B,81C 'file':5A,30B,55B,67C 'flaw':36B 'fusion':2A,19B,40B,77C 'get':48B 'inject':35B,73C 'malici':27B,64C,83C 'markdown':34B,72C 'may':85C 'open':52B 'post':41B,78C 'processor':42B,79C 'run':6A,57B 'stack.json':4A,29B,66C 'trigger':32B,69C 'trust':71C 'user':10A,50B,62B,99C 'util':43B,80C 'vscode':24B 'vscode-extens':23B 'vulner':74C,88C","nicknames":[],"mitigations":[],"who_affected":"Teams that edit Fusion/Inventor CAM/HSMWorks post processors in VS Code with the Autodesk Fusion Post Processor Utility extension and open .stack.json files from outside sources. Affected versions and fixed version are not published in any source I could read. Anyone who does not have this extension installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T16:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@autodesk.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107672","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107672","severity":null,"published_at":"2026-10-27T16:17:29+00:00","modified_at":"2026-10-27T16:17:29+00:00","first_seen_at":"2026-10-27T16:33:07+00:00","fetched_at":"2026-10-27T16:33:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107672:889","url":null,"severity":null,"published_at":"2026-10-27T16:36:47+00:00","modified_at":"2026-10-27T16:36:47+00:00","first_seen_at":"2026-10-27T16:36:47+00:00","fetched_at":"2026-10-27T16:36:47+00:00","note":"No Autodesk advisory for this CVE found yet: trust-center index tops out at ADSK-SA-2026-0017 (Oct 14); GitHub Autodesk/cam-posteditor has no releases or advisories. Fix/affected versions unknown. Fusion Oct 20 build 2706.1.14 release notes say 'Updated Fusion Post Processor Utility extension' but do not tie it to this CVE. Do not confuse with CVE-2026-10789 (ADSK-SA-2026-0008, Fusion MCP extension, fixed 2703.1.20), a different bug. Recheck once Autodesk publishes the advisory."}],"documents":[{"id":6989,"url":"https://www.autodesk.com/trust/security-advisories","title":"Autodesk security advisories index (no entry for this CVE as of 2026-10-27)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":6990,"url":"https://marketplace.visualstudio.com/items?itemName=Autodesk.hsm-post-processor","title":"Autodesk Fusion Post Processor Utility (VS Code extension)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}