What’s Vulnerable › Vulnerabilities
CVE-2026-9264: Cross-Site Scripting in SketchUp Dynamic Components
- Severity: critical (CVSS 9.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-22 · updated 2026-07-23
- Weakness: CWE-94
Description
A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.
Affected products
- Trimble SketchUp: before 2026.1.3 — fixed in 2026.1.3
How to fix
Upgrade to a fixed version: Trimble SketchUp 2026.1.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-9264 or the next vulnerability affects your stack