CVE-2026-4344

Stored Cross-Site Scripting (XSS) Vulnerability in Assembly Component Name

Published Apr 14, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Analysis

Technical impact

A maliciously crafted HTML payload can be stored within a component name and then shown in the Fusion desktop application's delete‑confirmation dialog; clicking the link triggers a stored cross‑site scripting event. The attacker can read local files or execute arbitrary code within the context of the running Fusion process, a flaw classified as CWE‑79.

Affected Systems

The vulnerability affects Autodesk Fusion desktop versions, with the current CPE indicating impact on 2606.0. Any installation of this release that allows component names to contain arbitrary HTML is at risk.

Risk and Exploitability

The CVSS score of 7.1 signals a high severity. Exploitation requires a user to interact with the malicious link presented in the confirmation dialog, so user action is mandatory. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation data at present. If successfully exploited, the attacker gains code execution privileges equivalent to the Fusion process, potentially allowing local file disclosure or broader compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Autodesk

Fusion

unaffected

Version	Status	Constraints
`2606.0`	affected	< 2702.1.47

Configuration 1 [-]

cpe:2.3:a:autodesk:fusion:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Autodesk

Fusion

Version	Status	Scheme	Platform
`[2606.0,2702.1.47)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check Autodesk’s website for an updated Fusion installer or patch; upgrade to the latest version when available.
If no patch is immediately available, delete or rename any component names that contain unexpected HTML or script fragments to prevent the dialog from rendering malicious content.
If Fusion offers a setting to disable embedded web‑view or script rendering, enable it until a vendor repair is released.
Monitor Fusion logs and user activity for unusual delete‑confirmation dialogs or script execution events.

Generated by OpenCVE AI on April 14, 2026 at 15:51 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.208% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0005

History

Apr 22, 2026 3:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:autodesk:fusion::::::::

Apr 14, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 14, 2026 2:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Title		Stored Cross-Site Scripting (XSS) Vulnerability in Assembly Component Name
First Time appeared		Autodesk Autodesk fusion
Weaknesses		CWE-79
CPEs		cpe:2.3:a:autodesk:fusion:2606.0:::::::*
Vendors & Products		Autodesk Autodesk fusion
References		https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0005
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}`