This vulnerability involves a stored XSS flaw (CWE-79) in Autodesk Fusion 2606.0, where a crafted HTML payload in an assembly variant name is rendered in the delete confirmation dialog. User interaction with this dialog triggers script execution, enabling an attacker to perform actions such as reading local files or executing code in the application's process context. The CVSS 3.1 vector indicates the attack requires local access and user interaction but has low complexity and no privileges required. The vulnerability is published but currently lacks an official fix or vendor advisory detailing remediation.

Successful exploitation can lead to arbitrary code execution or local file access within the context of the Autodesk Fusion process. This could compromise the confidentiality and integrity of local data accessible by the application. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with assembly variant names in delete confirmation dialogs, especially if sourced from untrusted inputs. No vendor-provided mitigation or workaround is currently available.