Fusion Post Processor Utility
Monthly
Command injection in the Autodesk Fusion Post Processor Utility extension (5.0.1 up to, but not including, 5.0.2) allows a remote attacker to execute arbitrary commands in the context of the current user when a victim opens a maliciously crafted .stack.json file. The attacker needs no credentials and the complexity is low, but exploitation is gated by user interaction: the hostile file must be delivered to and loaded by the target, so there is no zero-click remote path. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; impact is bounded by the privileges of the user who opens the file.
Command injection in the Autodesk Fusion Post Processor Utility extension (5.0.1 up to, but not including, 5.0.2) allows a remote attacker to execute arbitrary commands in the context of the current user when a victim opens a maliciously crafted .stack.json file. The attacker needs no credentials and the complexity is low, but exploitation is gated by user interaction: the hostile file must be delivered to and loaded by the target, so there is no zero-click remote path. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; impact is bounded by the privileges of the user who opens the file.