A maliciously crafted HTML payload can be stored within a component name and then shown in the Fusion desktop application's delete‑confirmation dialog; clicking the link triggers a stored cross‑site scripting event. The attacker can read local files or execute arbitrary code within the context of the running Fusion process, a flaw classified as CWE‑79.

The vulnerability affects Autodesk Fusion desktop versions, with the current CPE indicating impact on 2606.0. Any installation of this release that allows component names to contain arbitrary HTML is at risk.

The CVSS score of 7.1 signals a high severity. Exploitation requires a user to interact with the malicious link presented in the confirmation dialog, so user action is mandatory. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation data at present. If successfully exploited, the attacker gains code execution privileges equivalent to the Fusion process, potentially allowing local file disclosure or broader compromise.