Autodesk Fusion Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Autodesk Fusion desktop application. This issue arises when a maliciously crafted HTML payload is embedded in a design name. When the payload is displayed during the delete confirmation dialog and clicked by a user, it can execute arbitrary code or read local files in the context of the current process.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the user's context.

Remediation

Users are advised to update to Autodesk Fusion version 2606.1.22 or later. The latest version can be downloaded from the Autodesk Fusion Client Downloader available for Windows and Mac.