CVE-2026-9264: Trimble SketchUp Dynamic Components Cross-Site Scripting
CVE-2026-9264 is a cross-site scripting flaw in the Dynamic Components feature of Trimble SketchUp 2026, mapped to CWE-94 (Code Injection) in the record. The description reports impacts of remote code execution and local file exfiltration through crafted SKP files, and the CVSS 3.1 base score is 9.3. The record lists affected versions below 2026.1.3, provides no fix entries, and shows no CISA KEV listing.
Overview
CVE-2026-9264 affects the Dynamic Components feature of Trimble SketchUp 2026. According to the record, the flaw is a cross-site scripting issue caused by improper input sanitization in the component options window, and it is classified under CWE-94 (Code Injection).
Impact
The record states that the flaw may allow remote code execution and local file exfiltration. It also states that user interaction is not required and that an embedded Internet Explorer 11 browser is involved. The CVSS 3.1 base score is 9.3, with a scope change and high confidentiality, integrity and availability impact.
- Confidentiality, integrity and availability are all rated high in the vector.
- The attack vector is rated local (AV:L), which should be reconciled with the description's mention of remote code execution; the sources do not explain this difference.
Affected products and versions
The record lists Trimble SketchUp with versions below 2026.1.3 as affected. The fixes field is empty, so no fixed version is explicitly named. Organizations should confirm the exact remediation build with the vendor advisory.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, and the SSVC exploitation value is none. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Identify all installations of SketchUp 2026 and any earlier builds in the affected range.
- Review the vendor advisory from Trimble and apply the update that addresses the Dynamic Components issue, moving to a build at or above 2026.1.3 unless the vendor states otherwise.
- Until patching is complete, restrict opening SKP files from untrusted or unknown sources and limit use of third-party Dynamic Components.
- Apply least-privilege principles to user accounts running design software.
Detection guidance
- Monitor for unexpected child processes launched by the SketchUp application.
- Review endpoint logs for unusual file access by SketchUp processes.
- Track file transfers of SKP files from external sources and flag unexpected ones for inspection.
Limitations of the available information
The record has a source status of Deferred and offers limited technical detail beyond the description. No vendor-specific exploit conditions, workarounds or fixed build numbers are provided in the record. The EPSS data is present, but its date does not clarify the analysis timeline.
Frequently asked questions
What is CVE-2026-9264?
It is a cross-site scripting vulnerability in the Dynamic Components feature of Trimble SketchUp 2026, mapped to CWE-94 in the record.
Which versions are affected?
The record lists Trimble SketchUp versions below 2026.1.3 as affected. It does not name an explicit fixed version, so confirm the build with the vendor.
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.