A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 14, 2026 · NIST NVD

   Detected

   A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

2. Jun 17, 2026 · NIST NVD

   Updated

   A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Affected

• cpe autodesk/fusionversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-4369

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-4369

  A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage thi

  nvd.nist.gov

References

• Product · dl.appstreaming.autodesk.com
• Product · dl.appstreaming.autodesk.com
• Vendor Advisory · autodesk.com