CVE-2026-4369: Autodesk Fusion Stored XSS Vulnerability

CVE-2026-4369 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Autodesk Fusion desktop application. The flaw exists in how the application handles assembly variant names containing maliciously crafted HTML payloads. When a user interacts with the delete confirmation dialog displaying a manipulated variant name, the embedded script executes within the application context. This vulnerability could allow an attacker to read local files or execute arbitrary code within the context of the current process.

Critical Impact
This Stored XSS vulnerability enables attackers to read local files and execute arbitrary code in the context of the Autodesk Fusion application, potentially compromising sensitive design data and user credentials.

Affected Products

Autodesk Fusion Desktop Application (Windows)
Autodesk Fusion Desktop Application (macOS)

Discovery Timeline

2026-04-14 - CVE-2026-4369 published to NVD
2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-4369

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The Autodesk Fusion desktop application fails to properly sanitize user-controlled input in assembly variant names before rendering them in the user interface. When the application displays a delete confirmation dialog containing a maliciously crafted variant name, any embedded HTML or JavaScript code is executed rather than being treated as plain text.

The local attack vector requires user interaction—specifically, a user must view and interact with the delete confirmation dialog for the malicious payload to trigger. Despite requiring local access and user interaction, the vulnerability poses significant risk because successful exploitation grants attackers the ability to read local files and execute arbitrary code within the application's process context.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the Autodesk Fusion application's handling of assembly variant names. The application renders variant names directly into the UI without properly sanitizing or escaping HTML special characters. This allows attackers to inject executable script content that persists within the project data and triggers when displayed in the delete confirmation dialog.

Attack Vector

An attacker with access to an Autodesk Fusion project could craft an assembly variant with a name containing malicious HTML/JavaScript payload. This could occur through several scenarios:

Shared Projects: A malicious actor creates a variant with an XSS payload in a shared collaborative project
Imported Files: A victim imports a project file containing the malicious variant name
Social Engineering: An attacker convinces a user to open a project file distributed via email or file sharing

When the victim attempts to delete the maliciously named variant, the delete confirmation dialog renders the variant name without proper sanitization. The embedded script executes with the privileges of the Fusion application, potentially accessing local files, stealing credentials, or executing system commands.

The vulnerability mechanism can be understood as follows: The assembly variant name field accepts arbitrary text input including HTML tags. When this name is displayed in the delete confirmation dialog, the application's embedded browser or UI framework interprets the HTML content as executable markup rather than escaped text. This allows script elements to execute within the application's security context.

For detailed technical information, refer to the Autodesk Security Advisory ADSK-SA-2026-0005.

Detection Methods for CVE-2026-4369

Indicators of Compromise

Unusual assembly variant names containing HTML tags such as <script>, <img>, <svg>, or event handlers like onerror, onload
Unexpected network connections originating from the Autodesk Fusion process
Fusion application attempting to access sensitive files outside normal project directories
Anomalous process spawning from Autodesk Fusion executable

Detection Strategies

Monitor Autodesk Fusion project files for variant names containing suspicious HTML or JavaScript patterns
Implement endpoint detection rules to identify script injection patterns in Fusion file formats
Configure application-level logging to capture variant name modifications and deletions
Deploy behavioral analysis to detect Fusion processes accessing unexpected system resources

Monitoring Recommendations

Enable enhanced logging for Autodesk Fusion application activities
Monitor for unusual file access patterns by the Fusion application process
Track network connections initiated by Fusion for unexpected external communications
Implement file integrity monitoring on shared project directories

How to Mitigate CVE-2026-4369

Immediate Actions Required

Update Autodesk Fusion to the latest patched version immediately
Review recently accessed shared projects for suspicious assembly variant names
Restrict access to shared Fusion projects until patching is complete
Educate users about the risk of opening untrusted project files

Patch Information

Autodesk has released security patches to address this vulnerability. Users should download and install the latest version of Autodesk Fusion:

Windows: Download the updated client from the Autodesk Fusion Client Downloader (EXE)
macOS: Download the updated client from the Autodesk Fusion Client Downloader (DMG)

For complete details on the security update, consult the Autodesk Security Advisory ADSK-SA-2026-0005.

Workarounds

Exercise caution when opening Fusion project files from untrusted sources
Avoid interacting with delete confirmation dialogs for variants with unusual or suspicious names
Temporarily disable shared project access until the patch is applied
Review project file contents in a sandboxed environment before opening in production

bash

# Verify Autodesk Fusion version on Windows
# Navigate to Help > About in Autodesk Fusion to verify updated version
# Or check installation directory for version information

# For enterprise deployments, use software inventory tools to identify
# unpatched Fusion installations across the organization