The flaw allows a maliciously crafted HTML payload in the description field of an electronic library (.lbr) file to be executed when the library is displayed in the Library Manager after import. This stored XSS can read local files or execute arbitrary code within the Autodesk Fusion desktop process, potentially compromising confidentiality, integrity, or availability of the host system. The weakness is a classic reflected XSS via user‑controlled input stored and later rendered, identified as CWE‑79.

The vulnerability affects Autodesk Fusion Desktop, version 2705.1.30 and any releases that handle .lbr files in the same manner. The affected product is listed as Autodesk Fusion 2705.1.30 in the CPE string, indicating that build is impacted without a broader version range provided by the CNA.

The CVSS score of 7.1 reflects moderate to high risk; the EPSS score is not available, so exploit likelihood is uncertain. The vulnerability is not listed in the CISA KEV catalogue, indicating that while it is documented, it has not been identified as a widespread or actively exploited vulnerability by CISA at this time. Attackers would need to deliver a malicious .lbr file containing the payload, which can be done via email, shared network drive, or any channel allowing library import. Once imported, rendering the Library Manager will trigger the script in the context of the Fusion application, without needing elevation. The potential for local file read or arbitrary code execution means all users of the affected application are at risk if they import untrusted libraries.