A maliciously crafted HTML payload embedded in a design name is stored by Autodesk Fusion Desktop. When a second user opens the same design, the application displays the design name in a context that interprets the HTML, allowing a Stored Cross‑Site Scripting (CWE‑79) vulnerability. The injected script can read local files or execute arbitrary code within the process of the Fusion application, potentially compromising confidentiality, integrity, or availability of the affected system.

Autodesk Fusion Desktop version 2705.1.30 is confirmed to contain the flaw. No other versions are explicitly listed in the advisory, so the impact is presently limited to this version unless newer releases also include the vulnerability.

The CVSS score of 7.1 classifies the flaw as high severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a malicious design file that carries the crafted name; the victim must open the file on a machine running the affected Fusion Desktop version. No remote network entry or privilege escalation beyond normal user level is needed. The risk of exploitation depends on the frequency of malicious design files in shared environments or email attachments.