CVE-2026-10789 — MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop
A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that c…
Published: 2026-06-22 · CVSS: 9.6 · CVSS 3.1
A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7