HarborGuard / CVE
Back to search
HIGHCVE-2026-4345Published Modified CNA autodesk

CVE-2026-4345: Stored Cross-Site Scripting (XSS) Vulnerability in Design Name

A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Metrics

CVSS v3.1
7.1
Severity
HIGH
Fixed in
2702.1.47
Affected Products
1

Fix available

2702.1.47
Patch commits
Affected packages
  • Autodesk / Fusion
    < 2702.1.47 (from 2606.0)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
References