{"id":"CVE-2026-107672","title":"Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility","summary":"A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the cont…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-77"],"vendor":"Autodesk","product":"Fusion Post Processor Utility","affected":["fusion_post_processor_utility >= 5.0.1 < 5.0.2"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T16:04:04.713Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107672","references":[{"url":"https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0018"},{"url":"https://marketplace.visualstudio.com/items?itemName=Autodesk.hsm-post-processor"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T16:32:34.415Z","slug":"CVE-2026-107672","body":"## Overview\n\nA maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user.\n\n## Affected\n\n- `fusion_post_processor_utility >= 5.0.1 < 5.0.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}