Stored Cross-site Scripting Vulnerability in Autodesk Fusion Application

CVE-2026-102638

What is CVE-2026-102638?

A stored cross-site scripting vulnerability exists in the Autodesk Fusion desktop application due to a crafted HTML payload contained within the description of an electronic library (.lbr) file. When the library is imported and viewed in the Library Manager, this payload can be executed, allowing an attacker to potentially read local files or run arbitrary code within the context of the user's active session. This vulnerability poses significant security risks if exploited, highlighting the need for users to apply the latest security patches from Autodesk.

References