https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T16:04:49.699044+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-123364 fkie_cve-2026-123364 2026-11-11T16:04:49.700262+00:00

OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7.

 https://db.gcve.eu/vuln/ghsa-p623-mxf7-qxjm GHSA-p623-mxf7-qxjm — OctoPrint: Stored XSS via saved connection parameters 2026-11-11T16:04:49.700312+00:00

Affected: PyPI: OctoPrint

## Impact

OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default `port` or `baudrate` setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a `connect` request.

## Patches

The vulnerability is patched in 2.0.0rc7.

## Workaround

Check `config.yaml` for Javascript fragments in `printerConnection.preferred.parameters.port` or `printerConnection.preferred.parameters.baudrate`. If found, remove them. You can check who of your users had access to your instance since you flashed 2.0.0rc1 or above via `auth.log`.

## Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by "mahn-don".

## Timeline

2026-10-14: Report received 2026-10-14: Report acknowledged 2026-10-14: Report verified 2026-10-14: Fix ready for 2.0.0rc7 2026-10-20: CVE requested