CVE-2026-9264

9.3 Critique

Publiée le 22/05/2026 à 04:16 · Modifiée le 23/07/2026 à 14:10 · Analyse NVD reportée · Source : 4ac701fe-44e9-4bcd-9585-dd6449257611

Description

A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.

Traduire en français

Produits concernés

Trimble SketchUp

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.3 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-94

Références

https://trust.trimble.com/?tcuUid=52252bc0-c196-4b1f-9f13-4e4c9ba247d9

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories