CVE-2026-0534: Autodesk Fusion Stored XSS Vulnerability

CVE-2026-0534 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Autodesk Fusion desktop application. A maliciously crafted HTML payload, stored in a part's attribute and clicked by a user, can trigger arbitrary code execution within the context of the current process. This vulnerability allows malicious actors to read local files or execute arbitrary code, posing a significant security risk to users of the Fusion desktop application.

Critical Impact
Successful exploitation enables attackers to read local files and execute arbitrary code in the context of the current process, potentially leading to sensitive data theft and system compromise.

Affected Products

Autodesk Fusion Desktop Application (Windows)
Autodesk Fusion Desktop Application (macOS)

Discovery Timeline

2026-01-22 - CVE-2026-0534 published to NVD
2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-0534

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The stored nature of this XSS vulnerability makes it particularly dangerous, as the malicious payload persists within the application's data structures and executes each time a user interacts with the compromised component.

The attack requires local access and user interaction—a victim must click on a maliciously crafted element within a part's attribute. Once triggered, the vulnerability allows the attacker to break out of the expected rendering context and execute arbitrary JavaScript or similar code within the application's process context. This can lead to unauthorized file system access and arbitrary code execution.

Root Cause

The root cause of this vulnerability lies in improper input validation and output encoding within the Autodesk Fusion desktop application. When handling HTML content stored in part attributes, the application fails to properly sanitize user-controllable input before rendering it in a context where it can be interpreted as executable code. This allows an attacker to inject malicious HTML and script payloads that persist in the application's data and execute when viewed by other users.

Attack Vector

The attack vector for CVE-2026-0534 is local, requiring an attacker to craft a malicious HTML payload and embed it within a part's attribute in Autodesk Fusion. The attack chain proceeds as follows:

An attacker creates or modifies a Fusion document, embedding a malicious HTML payload within a part's attribute field
The compromised document is shared with or accessed by a victim user
When the victim opens the document and clicks on the malicious element, the stored XSS payload executes
The attacker's code runs in the context of the Fusion application process, enabling local file access and arbitrary code execution

The vulnerability manifests when the application renders HTML content from part attributes without proper sanitization. Attackers can embed script tags or event handlers within attribute values that execute when the content is displayed. For detailed technical information, refer to the Autodesk Security Advisory ADSK-SA-2026-0001.

Detection Methods for CVE-2026-0534

Indicators of Compromise

Unexpected script execution or browser-like behavior within the Fusion application
Suspicious file system access attempts originating from the Fusion process
Unusual network connections initiated by the Fusion desktop application
Modified or suspicious part attribute values containing HTML or script content

Detection Strategies

Monitor Fusion application processes for unusual child process spawning or file access patterns
Implement file integrity monitoring on Fusion document files to detect potential payload injection
Review Fusion project files for suspicious HTML or JavaScript content within part attributes
Deploy endpoint detection solutions to identify anomalous behavior from desktop applications

Monitoring Recommendations

Enable detailed logging for the Autodesk Fusion application to capture user interactions and potential exploit attempts
Configure endpoint detection and response (EDR) tools to monitor for script execution within desktop application contexts
Implement network monitoring to detect unexpected outbound connections from the Fusion application process

How to Mitigate CVE-2026-0534

Immediate Actions Required

Update Autodesk Fusion to the latest version that addresses CVE-2026-0534
Review and audit Fusion project files from untrusted sources before opening
Restrict access to shared Fusion documents to trusted users only
Enable SentinelOne endpoint protection to detect and block exploitation attempts

Patch Information

Autodesk has released security updates to address this vulnerability. Users should download and install the latest version of Autodesk Fusion:

Windows: Download the updated installer from the Autodesk Fusion Client Windows Installer
macOS: Download the updated installer from the Autodesk Fusion Client Mac Installer

For complete details on the security fix, refer to the Autodesk Security Advisory ADSK-SA-2026-0001.

Workarounds

Avoid opening Fusion documents from untrusted or unknown sources until patches are applied
Implement strict access controls on shared Fusion project repositories
Consider using application sandboxing to limit the potential impact of exploitation
Train users to recognize and report suspicious elements within Fusion documents

bash

# Verify Fusion installation version (Windows PowerShell)
# Check the installed version to ensure you have the patched release
Get-ItemProperty "HKLM:\SOFTWARE\Autodesk\Fusion 360\*" | Select-Object DisplayName, DisplayVersion