A maliciously crafted HTML payload can be stored in the description of an electronic library component and executed when a user interacts with that description, leading to a Stored Cross‑Site Scripting flaw that may allow reading local files or running arbitrary code inside the Fusion desktop process. The vulnerability arises from inadequate sanitization of user‑supplied content (CWE-79) and permits both information disclosure and execution of code with the privileges of the running user.

The flaw targets Autodesk Fusion desktop versions up to at least 2603.0, as indicated by the product identifiers and CPE entries for Autodesk Fusion. The affected vendors are Autodesk; specific product name is Fusion.

The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1% suggests current industrial exploitation probability is low but not negligible. The vulnerability is not listed in the CISA KEV catalog, but its potential to execute code in the user’s session makes it a significant risk. The likely attack path involves a malicious actor inserting a crafted description, which a user subsequently clicks, triggering the stored XSS in the Fusion client.