A maliciously crafted HTML payload can be embedded in an assembly variant name and will be displayed in the delete confirmation dialog of Autodesk Fusion. If the user clicks the dialog a stored XSS is triggered, allowing an attacker to read local files or execute arbitrary code within the Fusion process context.

The vulnerability affects Autodesk Fusion desktop version 2606.0. Any installation that has not been updated beyond this version may run with the unpatched code, rendering users susceptible to the exploit.

The flaw carries a CVSS score of 7.1, indicating moderate‑to‑high severity. Exploitation requires the victim to interact with the malicious confirmation dialog, but once triggered the impact on confidentiality and integrity is significant. EPSS data is unavailable and the issue is not listed in CISA’s KEV catalog, yet the combination of a high CVSS, required user action, and the potential for arbitrary code execution presents a realistic risk in typical environments.