PT-2026-42704 · Trimble · Sketchup 2026

Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-9264

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SketchUp 2026

Description A cross-site scripting (XSS) issue in the Dynamic Components feature allows remote code execution and local file exfiltration via maliciously crafted SKP files. The flaw is caused by improper input sanitization in the component options window, which enables attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-9264

Affected Products

Sketchup 2026

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9264 · Security Note
• https://twitter.com/CVEnew/status/2057783184541008118 · Twitter Post
• https://trust.trimble.com/?tcuUid=52252bc0-c196-4b1f-9f13-4e4c9ba247d9 · Note