Adobe Dimension has a cross‑site scripting vulnerability that allows a local attacker to inject malicious code into the web page generation process. The flaw is an improper neutralization of user input (CWE‑79) and can be leveraged to execute arbitrary code with the same privileges as the target user. Since the flaw resides in the rendering engine, the attacker can embed script that runs when the user opens a crafted file or link within the application.

The affected product is Adobe Dimension. No specific product versions are listed in the advisory. Users running any installation of Adobe Dimension may be impacted until a patch is applied.

The reported CVSS score of 8.6 indicates a high severity vulnerability. The EPSS score is less than 1%, indicating a very low exploitation probability. The issue is not listed in the CISA KEV catalog. Exploitation requires the victim to launch the application with the malicious input, so the attack vector is a local user‑interaction scenario, and the scope is changed, potentially affecting additional system components once the code is executed.