A maliciously crafted HTML payload, stored in a part’s attribute, can be triggered when a user clicks the part. The payload exploits a Stored Cross‑site Scripting flaw in the Autodesk Fusion desktop application, allowing an attacker to read local files or execute arbitrary code in the same context as the application. This can compromise the confidentiality, integrity, and availability of the system and any data handled by Fusion.

The vulnerability affects the Autodesk Fusion desktop application, specifically the 2603.0 version. Any user of this version that opens parts containing attacker‑controlled attribute values is at risk.

The CVSS score of 8.1 indicates moderate to high risk, while the EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack requires user interaction to open or click a malicious part, so the likely attack vector is a social engineering or insider scenario. Successful exploitation would give the attacker code execution privileges within the Fusion process, potentially exposing local files and data.