CVE-2026-4345

Stored Cross-Site Scripting (XSS) Vulnerability in Design Name

Published Apr 14, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Analysis

Technical impact

A maliciously crafted HTML payload can be stored inside a design name and then exported to CSV, triggering a stored Cross‑Site Scripting vulnerability in Autodesk Fusion desktop. The flaw allows an attacker to read local files or execute arbitrary code in the context of the Fusion process, exposing confidentiality, integrity, or availability of data. The weakness corresponds to CWE‑79.

Affected Systems

The affected product is Autodesk Fusion desktop, specifically version 2606.0. This release, as identified by its CPE designation, is vulnerable, and any older builds that use a similar identifier may also be impacted.

Risk and Exploitability

The CVSS v3.1 score is 7.1, indicating high severity. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user to open the compromised design or export it to CSV, implying a user‑dependent or local attack vector. Once the payload is rendered, an attacker can read arbitrary files or execute code with the same privileges as the Fusion process.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Autodesk

Fusion

unaffected

Version	Status	Constraints
`2606.0`	affected	< 2702.1.47

Configuration 1 [-]

cpe:2.3:a:autodesk:fusion:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Autodesk

Fusion

Version	Status	Scheme	Platform
`[2606.0,2702.1.47)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check Autodesk’s security advisories and install any available update for Fusion that addresses the stored XSS vulnerability.
If an update is not yet available, avoid using design names that contain HTML or JavaScript fragments, and refrain from opening CSV files exported from unknown or untrusted sources.
Configure Fusion to run with the least privileges necessary and restrict write permissions to directories that contain design files.
Monitor Fusion logs for unexpected script execution or file read attempts and investigate any anomalies.

Generated by OpenCVE AI on April 14, 2026 at 15:51 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.208% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0005

History

Apr 22, 2026 3:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:autodesk:fusion::::::::

Apr 14, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 14, 2026 2:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Title		Stored Cross-Site Scripting (XSS) Vulnerability in Design Name
First Time appeared		Autodesk Autodesk fusion
Weaknesses		CWE-79
CPEs		cpe:2.3:a:autodesk:fusion:2606.0:::::::*
Vendors & Products		Autodesk Autodesk fusion
References		https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0005
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}`