CVE-2025-10244
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may leverage this to read local files or execute arbitrary code in the context of the current process.
Risk Assessment
This could lead to data confidentiality breach or arbitrary code execution on the user's machine.
Recommendation
Update Autodesk Fusion to the latest version and avoid opening untrusted HTML files.
Other vulnerabilities in Autodesk Fusion
See all- CVE-2026-113775High
Autodesk Fusion contains an Exposed Dangerous Function vulnerability via the TextCommands.LoadDll API command. A maliciously crafted dynamic library loaded from an arbitrary path can execute arbitrary code in the context of the current process.
- CVE-2026-102638High
A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
- CVE-2026-102637High
A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
- CVE-2026-102636High
A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Original NVD description (English source)
A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS