CVEvulnerability

CVE-2026-4345

7.1 HIGH Published 2026-04-14 Modified 2026-10-26 Official page ↗

Status: Analyzed
Published: 2026-04-14
Last modified: 2026-10-26
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses: CWE-79

Description

A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Affected configurations

• autodesk fusion (< 2702.1.47)

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References

https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg Product
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe Product
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0005 Vendor Advisory

CVE-2026-4345

Description

Affected configurations

Related

Weakness · CWE (1)

References