7.1
High
CVE-2026-102637 Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
Description
A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NExploitable with local access to the machine, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Fusion 2705.1 | 2705.1.30 → < 2706.1.14 | 2706.1.14 |
Other CVEs of Fusion
The 13 CVEs of Fusion →
CVE-2026-113775
A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command…
7.8
High
CVE-2026-102638
Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
7.1
High
CVE-2026-102636
Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
7.1
High
CVE-2026-85217
A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network…
8.6
High