fkie_cve-2026-123364

OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7.

GHSA-p623-mxf7-qxjm — OctoPrint: Stored XSS via saved connection parameters

Affected: PyPI: OctoPrint

## Impact

OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default `port` or `baudrate` setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a `connect` request.

## Patches

The vulnerability is patched in 2.0.0rc7.

## Workaround

Check `config.yaml` for Javascript fragments in `printerConnection.preferred.parameters.port` or `printerConnection.preferred.parameters.baudrate`. If found, remove them. You can check who of your users had access to your instance since you flashed 2.0.0rc1 or above via `auth.log`.

## Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by "mahn-don".

## Timeline

2026-10-14: Report received 2026-10-14: Report acknowledged 2026-10-14: Report verified 2026-10-14: Fix ready for 2.0.0rc7 2026-10-20: CVE requested

Most recent entries from all

fkie_cve-2026-123364

GHSA-p623-mxf7-qxjm — OctoPrint: Stored XSS via saved connection parameters