A cross‑site scripting flaw exists in SketchUp 2026’s Dynamic Components feature that allows a maliciously crafted SKP file to embed JavaScript which is executed through an embedded Internet Explorer 11 browser. The vulnerability arises from improper input sanitization in the component options window. When a user opens such a file, the embedded script can run arbitrary system commands and read local files, effectively providing the attacker with remote code execution and local data exfiltration capabilities, all without the user needing to interact beyond opening the file.

Trimble’s SketchUp 2026 product (the Dynamic Components feature). The issue affects any installation that includes this module.

The CVSS score for this vulnerability is 9.3, indicating high severity, while the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not currently included in the CISA KEV catalog, suggesting that no widespread exploits are documented. Attackers would need to supply a malicious SKP file and entice a user to open it; no remote network access is required. Because the flaw allows execution of arbitrary system commands and local file reads, the potential impact on confidentiality, integrity, and availability is high for any affected system.