Fusion CVE-2026-4344

Local attacker creates a component with malicious HTML in its name. Victim must use Autodesk Fusion desktop application, open the project containing the malicious component, and click the delete confirmation dialog. Requires local file system access and user interaction.

Real-world risk is moderate despite the 7.1 CVSS score. The attack complexity is low (AC:L) but requires local access (AV:L) and user interaction (UI:R), significantly limiting exploitation scenarios compared to remote vulnerabilities. An attacker must either have existing local access to create malicious component names, or convince a user to import/open a crafted Fusion project file containing the payload. The no-privileges-required (PR:N) aspect means any local user can trigger the vulnerability without admin rights. The dual-impact classification (both XSS and RCE tags) elevates concern: while the initial vector is XSS, the ability to execute arbitrary code in the desktop application context makes this more severe than typical web-based XSS. No EPSS score provided, but the local attack vector and requirement for social engineering (convincing users to interact with crafted content) reduce the probability of mass exploitation. No KEV listing or public POC identified, suggesting this remains a theoretical risk rather than an actively exploited threat. Priority should focus on environments where users regularly share Fusion project files from untrusted sources.

An attacker creates a malicious Autodesk Fusion project file containing a component with a crafted HTML/JavaScript payload embedded in its name field, such as <img src=x onerror=maliciousCode()>. The attacker distributes this project file through email, file sharing, or collaborative engineering platforms. When a victim opens the project in Fusion and attempts to delete the malicious component, the delete confirmation dialog renders the unescaped HTML, executing the embedded JavaScript. This code could then read sensitive CAD files from the local filesystem, exfiltrate intellectual property, or download and execute additional malware with the privileges of the Fusion application process. The local attack vector (AV:L) and user interaction requirement (UI:R) mean social engineering is essential, but in collaborative engineering environments where project files are routinely shared, this represents a realistic supply chain attack vector.