CVE-2026-102638 Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-102638?
CVE-2026-102638 is a high-severity vulnerability in Autodesk Fusion, published on 27 Oct 2026.
Official description
A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Weakness: CWE-79
Which versions are affected by CVE-2026-102638?
How do I fix CVE-2026-102638?
No fix has been published for CVE-2026-102638 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-102638 being exploited?
There is no known exploitation of CVE-2026-102638 in the wild and no public exploit code.
Sources
Also known as GHSA-f796-cqvh-43q8.