CVE-2026-103846: Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting) (CWE-79) in Adobe Adobe Dimension

CVE-2026-103846 is a cross-site scripting vulnerability (CWE-79) in Adobe Dimension that arises from improper neutralization of input during web page generation. A local attacker with user permissions can exploit this vulnerability to execute arbitrary code in the context of the current user. Exploitation requires that the victim runs the application, meaning user interaction is necessary. The vulnerability affects Adobe Dimension versions from 0 through 4.1.8 inclusive. The vulnerability has a CVSS v3.1 base score of 8.6, with attack vector local, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows arbitrary code execution in the context of the current user, potentially leading to full compromise of the user's environment within the application scope. The vulnerability requires local access and user interaction, limiting remote exploitation. The changed scope indicates that the impact extends beyond the vulnerable component itself, possibly affecting other components or data.

No official patch or remediation information is provided in the vendor advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running untrusted content in Adobe Dimension and limit local access to trusted users only.