Vulnerabilidades do Autodesk Fusion

CVE-2026-10789 Crítica · 9.6 CWE-94 22/06/2026

Vulnerabilidade de injeção de código na extensão MCP do Autodesk Fusion (CVE-2026-10789)

Uma página web maliciosamente elaborada, quando visitada por um usuário com o Autodesk Fusion Desktop em execução e a extensão MCP habilitada, pode acionar uma vulnerabilidade na extensão MCP que poderia permitir a execução arbitrária de código. Uma exploração bem-sucedida pode permitir que o código seja executado com os privilégios do usuário atual.

CVE-2026-4369 Alta · 7.1 CWE-79 14/04/2026

Stored Cross-Site Scripting (XSS) Vulnerability in Assembly Variant Name

A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

CVE-2026-4345 Alta · 7.1 CWE-79 14/04/2026

Stored Cross-Site Scripting (XSS) Vulnerability in Design Name

A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

CVE-2026-4344 Alta · 7.1 CWE-79 14/04/2026

Stored Cross-Site Scripting (XSS) Vulnerability in Assembly Component Name

A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

CVE-2026-0535 Alta · 8.1 CWE-79 22/01/2026

Stored XSS in Electronic Library Component Description

A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

CVE-2026-0534 Alta · 8.1 CWE-79 22/01/2026

Stored XSS in the value of a part attribute

A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

CVE-2026-0533 Alta · 8.1 CWE-79 22/01/2026

Stored XSS in Fusion desktop when attempting to delete a file

A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

CVE-2025-10244 Alta · 8.7 CWE-79 23/09/2025

HTML Payload Stored Cross-Site Scripting (XSS) Vulnerability

A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.