← Back

CVE-2026-10789

nvd nist
Published: Jun 22, 2026Modified: Jun 24, 2026

JSON object

Loading...
9.6
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 6.0
Source: psirt@autodesk.com (Secondary)

Description

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

Affected (1)

Products: Autodesk: Fusion
Autodesk
1 product
Fusion
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Fusion
Before 2703.1.20

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (3)

Source: psirt@autodesk.com
Product
Source: psirt@autodesk.com
Product
Source: psirt@autodesk.com
Vendor AdvisoryPatch

Timeline

No history available yet.