Autodesk Fusion Post Processor Utility: Markdown injection via crafted .stack.json file
Summary
A maliciously crafted .stack.json file can trigger a trusted Markdown injection in the Autodesk Fusion Post Processor Utility, a Visual Studio Code extension used to write and debug CAM post processors. An attacker who gets a user to open such a file can execute arbitrary commands in the context of that user. The CNA vector requires user interaction (UI:R) and no privileges.
Affected
- Autodesk Fusion Post Processor Utility 5.0.1 to before 5.0.2 (CNA record; default configuration unaffected)
- VulDB describes the range as up to 5.0.1 (third-party, not verified against the vendor advisory)
Fixed in
- Version 5.0.2 (from third-party sources; vendor advisory ADSK-SA-2026-0018 not yet verified)
Workaround
- Unknown. No vendor-documented workaround found.
- Interim measure, not vendor guidance: open post-processor projects and .stack.json files only from trusted sources until the update is installed.
Exploitation
- Not known to be exploited (OffSeq).
- VulDB states that no exploit exists.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof-of-concept or CISA KEV listing found at the time of research.
Our recommendation
- Inventory installations of the extension in VS Code on engineering and CAM workstations.
- Update to version 5.0.2 or later.
- Until updated, restrict how .stack.json files and post-processor packages reach these workstations, and open them only from trusted sources.
- Monitor the Autodesk security advisories for confirmation of the affected and fixed versions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Autodesk Fusion Post Processor Utility (Visual Studio Marketplace) marketplace.visualstudio.com
- Autodesk security advisory ADSK-SA-2026-0018 www.autodesk.com
- VulDB entry CVE-2026-107672 vuldb.com
- OffSeq threat radar entry radar.offseq.com
- Strix CVE mirror CVE-2026-107672 www.strix.ai
- Autodesk cam-posteditor repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:13.
Original description (NVD)
A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.