CVE-2026-107672 in Fusion Post Processor Utility
Summary
by MITRE • 10/27/2026
A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The Autodesk Fusion Post Processor Utility Extension contains a critical security flaw related to how it processes configuration files, specifically those with the .stack.json extension. This vulnerability stems from an improper neutralization of special elements within input data, which classifies as CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or in this context, trusted Markdown injection. The core issue lies in the application's failure to adequately sanitize user-supplied content before rendering it through its markdown processing engine. When a malicious actor crafts a .stack.json file containing specially designed payloads embedded within markdown syntax, the extension interprets these elements as legitimate commands rather than static text data. This lack of strict input validation allows an attacker to inject arbitrary code that is then executed by the host application during the rendering or parsing phase.
From a technical perspective, this vulnerability exploits the trust relationship between the post processor utility and its configuration files. The extension assumes that .stack.json files are safe because they are part of the local project structure, but it fails to distinguish between benign configuration data and malicious script injections. By leveraging markdown syntax features such as HTML tags or executable code blocks within the JSON content, an attacker can bypass standard security controls. Once processed, these injected elements trigger execution contexts that allow for arbitrary command execution on the victim's machine. This is particularly dangerous because it occurs in the context of the current user, meaning any permissions held by the logged-in account are inherited by the malicious code, potentially leading to full system compromise if elevated privileges exist.
The operational impact of this vulnerability is severe, as it enables remote or local code execution depending on how the malicious file is introduced into the victim's environment. If an attacker can trick a user into opening a compromised project file containing the crafted .stack.json payload, they gain immediate access to execute system commands without authentication. This capability allows for data exfiltration, installation of additional malware, pivoting within a network if connected, or complete disruption of development workflows by corrupting critical design files and settings. The attack vector is relatively simple yet effective because it targets the automated processing features intended to streamline CAD post-processing tasks, turning a convenience feature into a significant security risk.
To mitigate this vulnerability, Autodesk should implement strict input validation and output encoding mechanisms within the Post Processor Utility Extension. This includes whitelisting allowed markdown syntax elements and ensuring that any dynamic content is properly escaped before being rendered by the parser. Additionally, implementing sandboxing for post-processing scripts can limit the potential damage of an exploit by restricting file system access and command execution capabilities to a minimal set of required operations. Users should be advised to exercise caution when opening project files from untrusted sources and to keep their Autodesk Fusion software updated with the latest security patches once they are released. Regular audits of third-party extensions for similar input handling flaws are also recommended to prevent recurrence of such injection-based attacks across related tools in the ecosystem.