This vulnerability involves a stored XSS (CWE-79) in Autodesk Fusion 2606.0, where malicious HTML embedded in a design name is executed when exported to CSV. This can lead to local file access or arbitrary code execution within the application process. The CVSS 3.1 score of 7.1 reflects high impact on confidentiality and integrity, with low attack complexity and no privileges required but user interaction needed. Autodesk has published the vulnerability but has not yet provided an official fix or mitigation guidance. The product is a desktop application, not a cloud service.

Successful exploitation allows an attacker to execute arbitrary code or read local files in the context of the Autodesk Fusion desktop application process, potentially compromising confidentiality and integrity of local data. Availability impact is not indicated. The vulnerability requires user interaction (exporting the CSV) and local access to the application.

No official patch or remediation guidance is currently available from Autodesk. Users should exercise caution when exporting CSV files containing design names from untrusted sources. Monitor Autodesk advisories for updates on patches or mitigations. Avoid opening CSV exports from unknown or suspicious designs until a fix is released.