Listen to this Post
The CVE-2025-10244 vulnerability exploits the HTML rendering engine within the Autodesk Fusion desktop application. This engine fails to properly sanitize user-controlled input when processing HTML content, such as from project files or embedded web views. An attacker can craft a malicious HTML payload containing JavaScript code. When a user opens or previews this payload in Fusion, the application renders the HTML without neutralizing the script elements. The JavaScript executes within the application’s process context, which has access to local system resources. This stored cross-site scripting (XSS) allows the malicious payload to persist within saved Fusion files, enabling repeated triggers. The executed script can leverage Fusion’s internal APIs or standard web APIs available in the embedded environment to read local files from the file system. Furthermore, by chaining JavaScript functions, the script can potentially spawn new processes or invoke system commands, leading to arbitrary code execution. The vulnerability requires user interaction, such as opening a crafted file, but social engineering can easily facilitate this. The impact is severe because Fusion typically runs with the user’s privileges, allowing the attacker to perform actions on the victim’s behalf. The core flaw is the excessive trust in HTML content without adequate validation or sandboxing in the desktop application’s web view component.
Platform: Autodesk Fusion
Version: All affected versions
Vulnerability: Stored XSS
Severity: Critical
date: 2025-09-23
Prediction: Q4 2025 patch
What Undercode Say:
Analytics:
Check for Autodesk Fusion installation on macOS
ls /Applications/ | grep -i autodesk
Create a simple malicious HTML test payload
echo '<script>alert("XSS")</script>' > test_payload.html
<!-- Sample malicious HTML payload for proof-of-concept -->
<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'file:///C:/Windows/win.ini', false);
xhr.send();
if(xhr.status==200) { console.log(xhr.responseText); }
</script>
How Exploit:
Craft malicious HTML file. Embed in Fusion project. User opens file. Script executes. Reads files or runs commands.
Protection from this CVE:
Update Fusion software. Avoid untrusted files. Disable unnecessary scripts.
Impact:
Local file read. Arbitrary code execution. System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
