TI-2026-81385 Aliases CVE-2026-107672 GHSA-x2ww-vrx6-xvhh

Trusted Markdown injection in Autodesk Fusion Post Processor Utility

MEDIUM 40CWE-77Published 2026-10-27 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

Autodesk Fusion Post Processor Utility Extension from 5.0.1 before 5.0.2 contains a trusted Markdown injection flaw, classified as CWE-77 (command injection). A maliciously crafted .stack.json file can trigger the injection. A malicious actor may exploit this to execute arbitrary commands in the context of the current user.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00337 27th percentileScored 2026-11-07

Fix Fixed Fusion Post Processor Utility (Autodesk): 5.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Autodesk	Fusion Post Processor Utility	5.0.1 to before 5.0.2	5.0.2	Patch available	CNA

Fusion Post Processor Utility VendorAutodesk Affected 5.0.1 to before 5.0.2 Fixed in 5.0.2 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:autodesk:fusion_post_processor_utility:5.0.1:::::::*	5.0.1	—	Autodesk

cpe:2.3:a:autodesk:fusion_post_processor_utility:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 — ·Autodesk

Remediation

Update Autodesk Fusion Post Processor Utility Extension to version 5.0.2, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA Fusion Post Processor Utility (Autodesk) Fixed in 5.0.2

Timeline

2026-10-27 Threatist record created from CVE-2026-107672
2026-10-27 Alias added: GHSA-x2ww-vrx6-xvhh
2026-10-28 Priority changed: MEDIUM → LOW
2026-10-29 CISA SSVC decision points changed
2026-10-29 Priority changed: LOW → MEDIUM
2026-10-29 CISA SSVC decision points changed

References

Patch 1

https://marketplace.visualstudio.com/items?itemName=Autodesk.hsm-post-processor

Advisory 1

https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0018

TI-2021-08603 Path traversal in Autodesk FBX Review CVSS 3.1HIGH 7.8
TI-2023-13523 Memory corruption in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
TI-2023-13522 Out-of-bounds write in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
TI-2014-02375 Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute… CVSS 2.0HIGH 10.0
TI-2008-04264 The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as… CVSS 2.0HIGH 9.3
TI-2008-04263 Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer… CVSS 2.0HIGH 9.3

See all 389 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences