A crafted HTML payload in the documentName parameter of a Fusion protocol URL triggers a reflected Cross‑Site Scripting vulnerability in the Autodesk Fusion desktop application when the URL is invoked by a user. This flaw can allow a malicious actor to read local files or execute arbitrary code in the context of the current Fusion process, compromising both confidentiality and integrity of local data and potentially achieving full control of the compromised workstation.

Autodesk Fusion Desktop version 2705.1.30 is affected. The vulnerability exists in the Fusion protocol handler that parses the documentName parameter of Fusion URLs.

The CVSS score of 7.1 indicates a high severity, but the EPSS score is not available, so the current exploitation probability is uncertain. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that the attack requires user interaction to open a crafted Fusion protocol URL, likely through a malicious link or email. Once the URL is activated, the reflected XSS can be exploited to read files or run code, representing a significant risk to any system where a user has the ability to execute such URLs.