The vulnerability occurs when a maliciously crafted .stack.json file is processed by the Autodesk Fusion Post Processor Utility Extension. The parsing of this file triggers a trusted markdown injection flaw that allows an attacker to execute arbitrary commands in the context of the user running the utility. Because the attacker can gain command‑execution privileges, the flaw can compromise confidentiality, integrity, and availability of the affected system.

Affected systems are installations of the Autodesk Fusion Post Processor Utility, specifically version 5.0.1 as indicated by the Common Platform Enumeration data. Users running this extension and loading .stack.json files from untrusted sources are at risk. The vendor, Autodesk, is identified as the CNA for this product.

The CVSS score of 8.8 reflects a high severity Remote Code Execution score. The EPSS score is not available, so the likelihood of exploitation is uncertain, but the flaw has not yet been listed in the CISA KEV catalog. Attackers would need to deliver a crafted .stack.json file to the target system; likely vectors include shared network drives, cloud project repositories, or downloaded extensions. Once the file is processed, the attacker can run arbitrary shell commands as the current user.