Vulnerability-Lookup

CVE-2026-35163 (GCVE-0-2026-35163)

Vulnerability from cvelistv5 – Published: 2026-08-21 18:25 – Updated: 2026-08-21 19:53

Title

OctoPrint: XSS in Suppressed Command Notifications

Summary

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim's OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3.

Severity

4.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-21 19:53 UTC

CWE

CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/OctoPrint/OctoPrint/security/a…	x_refsource_CONFIRM
https://github.com/OctoPrint/OctoPrint/commit/42e…	x_refsource_MISC
https://github.com/OctoPrint/OctoPrint/commit/6e3…	x_refsource_MISC
https://github.com/OctoPrint/OctoPrint/releases/t…	x_refsource_MISC
https://github.com/OctoPrint/OctoPrint/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
OctoPrint	OctoPrint	Affected: < 1.11.8 Affected: >= 2.0.0rc1, < 2.0.0rc3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35163",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T19:53:45.594944Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-21T19:53:55.905Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OctoPrint",
          "vendor": "OctoPrint",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0rc1, \u003c 2.0.0rc3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim\u0027s OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-21T18:25:49.564Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h"
        },
        {
          "name": "https://github.com/OctoPrint/OctoPrint/commit/42e0f9863935e136f04ed3c560cb96483a580d1b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OctoPrint/OctoPrint/commit/42e0f9863935e136f04ed3c560cb96483a580d1b"
        },
        {
          "name": "https://github.com/OctoPrint/OctoPrint/commit/6e3db9096f8a94f7c2249be24b6d03a7d9c12bc7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OctoPrint/OctoPrint/commit/6e3db9096f8a94f7c2249be24b6d03a7d9c12bc7"
        },
        {
          "name": "https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8"
        },
        {
          "name": "https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3"
        }
      ],
      "source": {
        "advisory": "GHSA-p6qx-ghxm-389h",
        "discovery": "UNKNOWN"
      },
      "title": "OctoPrint: XSS in Suppressed Command Notifications"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-35163",
    "datePublished": "2026-08-21T18:25:49.564Z",
    "dateReserved": "2026-04-01T17:26:21.132Z",
    "dateUpdated": "2026-08-21T19:53:55.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-35163",
      "date": "2026-10-17",
      "epss": "0.00199",
      "percentile": "0.09101"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "OctoPrint",
                "vendor": "OctoPrint",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.11.8"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.0.0rc1, \u003c 2.0.0rc3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim\u0027s OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3."
          },
          {
            "lang": "es",
            "value": "OctoPrint proporciona una interfaz web para controlar impresoras 3D de consumo. Antes de las versiones 1.11.8 y 2.0.0rc3, las ventanas emergentes de notificaci\u00f3n de Comando Suprimido utilizan el renderizado de PNotify para los valores payload.command y payload.message controlados por la impresora en src/octoprint/static/js/app/viewmodels/terminal.js sin escape HTML. Un atacante que convence a una v\u00edctima para imprimir un archivo manipulado puede inyectar HTML y JavaScript en la notificaci\u00f3n, interrumpir impresiones, leer informaci\u00f3n disponible para la v\u00edctima, incluyendo configuraciones sensibles cuando est\u00e9 permitido, o realizar acciones en la sesi\u00f3n de OctoPrint de la v\u00edctima. Este problema est\u00e1 solucionado en las versiones 1.11.8 y 2.0.0rc3."
          }
        ],
        "id": "CVE-2026-35163",
        "lastModified": "2026-10-14T19:10:00.297",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 4.6,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-35163",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-21T19:53:45.594944Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-21T19:17:01.170",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OctoPrint/OctoPrint/commit/42e0f9863935e136f04ed3c560cb96483a580d1b"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OctoPrint/OctoPrint/commit/6e3db9096f8a94f7c2249be24b6d03a7d9c12bc7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-80"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-35163",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-21T19:53:45.594944Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-21T19:53:51.597Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "OctoPrint",
              "vendor": "OctoPrint",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.11.8"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.0.0rc1, \u003c 2.0.0rc3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim\u0027s OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "LOCAL",
                "baseScore": 4.6,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "ACTIVE",
                "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "LOW"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-80",
                  "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-21T18:25:49.564Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h"
            },
            {
              "name": "https://github.com/OctoPrint/OctoPrint/commit/42e0f9863935e136f04ed3c560cb96483a580d1b",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OctoPrint/OctoPrint/commit/42e0f9863935e136f04ed3c560cb96483a580d1b"
            },
            {
              "name": "https://github.com/OctoPrint/OctoPrint/commit/6e3db9096f8a94f7c2249be24b6d03a7d9c12bc7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OctoPrint/OctoPrint/commit/6e3db9096f8a94f7c2249be24b6d03a7d9c12bc7"
            },
            {
              "name": "https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8"
            },
            {
              "name": "https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3"
            }
          ],
          "source": {
            "advisory": "GHSA-p6qx-ghxm-389h",
            "discovery": "UNKNOWN"
          },
          "title": "OctoPrint: XSS in Suppressed Command Notifications"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-35163",
        "datePublished": "2026-08-21T18:25:49.564Z",
        "dateReserved": "2026-04-01T17:26:21.132Z",
        "dateUpdated": "2026-08-21T19:53:55.905Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-35163

Vulnerability from fkie_nvd - Published: 2026-08-21 19:17 - Updated: 2026-10-14 19:10

Severity

4.6 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/OctoPrint/OctoPrint/commit/42e0f9863935e136f04ed3c560cb96483a580d1b
	security-advisories@github.com	https://github.com/OctoPrint/OctoPrint/commit/6e3db9096f8a94f7c2249be24b6d03a7d9c12bc7
	security-advisories@github.com	https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8
	security-advisories@github.com	https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3
	security-advisories@github.com	https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "OctoPrint",
          "vendor": "OctoPrint",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0rc1, \u003c 2.0.0rc3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim\u0027s OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3."
    },
    {
      "lang": "es",
      "value": "OctoPrint proporciona una interfaz web para controlar impresoras 3D de consumo. Antes de las versiones 1.11.8 y 2.0.0rc3, las ventanas emergentes de notificaci\u00f3n de Comando Suprimido utilizan el renderizado de PNotify para los valores payload.command y payload.message controlados por la impresora en src/octoprint/static/js/app/viewmodels/terminal.js sin escape HTML. Un atacante que convence a una v\u00edctima para imprimir un archivo manipulado puede inyectar HTML y JavaScript en la notificaci\u00f3n, interrumpir impresiones, leer informaci\u00f3n disponible para la v\u00edctima, incluyendo configuraciones sensibles cuando est\u00e9 permitido, o realizar acciones en la sesi\u00f3n de OctoPrint de la v\u00edctima. Este problema est\u00e1 solucionado en las versiones 1.11.8 y 2.0.0rc3."
    }
  ],
  "id": "CVE-2026-35163",
  "lastModified": "2026-10-14T19:10:00.297",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-35163",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T19:53:45.594944Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T19:17:01.170",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OctoPrint/OctoPrint/commit/42e0f9863935e136f04ed3c560cb96483a580d1b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OctoPrint/OctoPrint/commit/6e3db9096f8a94f7c2249be24b6d03a7d9c12bc7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-P6QX-GHXM-389H

Vulnerability from github – Published: 2026-06-23 17:15 – Updated: 2026-08-21 18:26

Summary

OctoPrint has XSS in its Suppressed Command Notifications

Details

Impact

OctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Suppressed Command notifications popups generated by the printer.

An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance.

Patches

The vulnerability has been patched in version 1.11.8 and 2.0.0rc3.

Workaround

OctoPrint administrators can mitigate the risk by disabling popups: - for Action Command notifications, set OctoPrint Settings -> Serial Connection -> Behaviour -> Sanity Checking -> Display notifications for suppressed commands to Never show notifications

It is also strongly recommended to ensure that files being printed originate from trusted sources, and, whenever possible, are sliced with an application's own slicer.

Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi.

Timeline

2026-03-18: Report received 2026-04-01: Report verified 2026-04-01: Fix ready for 2.0.0 2026-06-22: Fix backported to 1.11.x 2026-06-23: Fix released with 1.11.8 and 2.0.0rc3

Severity

4.6 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.11.7"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "OctoPrint"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.0.0rc2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "OctoPrint"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0rc1"
            },
            {
              "fixed": "2.0.0rc3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35163"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-23T17:15:14Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nOctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Suppressed Command notifications popups generated by the printer.\n\nAn attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance.\n\n### Patches\n\nThe vulnerability has been patched in version 1.11.8 and 2.0.0rc3.\n\n### Workaround\n\nOctoPrint administrators can mitigate the risk by disabling popups:\n- for Action Command notifications, set _OctoPrint Settings -\u003e Serial Connection -\u003e Behaviour -\u003e Sanity Checking -\u003e Display notifications for suppressed commands_ to _Never show notifications_\n\nIt is also strongly recommended to ensure that files being printed originate from trusted sources, and, whenever possible, are sliced with an application\u0027s own slicer.\n\n### Credits\n\nThis vulnerability was discovered and responsibly disclosed to OctoPrint by [Jacopo Tediosi](https://github.com/jacopotediosi).\n\n### Timeline\n\n2026-03-18: Report received\n2026-04-01: Report verified\n2026-04-01: Fix ready for 2.0.0\n2026-06-22: Fix backported to 1.11.x\n2026-06-23: Fix released with 1.11.8 and 2.0.0rc3",
  "id": "GHSA-p6qx-ghxm-389h",
  "modified": "2026-08-21T18:26:50Z",
  "published": "2026-06-23T17:15:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35163"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OctoPrint/OctoPrint"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2026-2688.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OctoPrint has XSS in its Suppressed Command Notifications"
}

PYSEC-2026-2688

Vulnerability from pysec - Published: 2026-07-13 15:46 - Updated: 2026-07-13 16:05

Details

Impact

Patches

The vulnerability has been patched in version 1.11.8 and 2.0.0rc3.

Workaround

It is also strongly recommended to ensure that files being printed originate from trusted sources, and, whenever possible, are sliced with an application's own slicer.

Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by Jacopo Tediosi.

Timeline

2026-03-18: Report received 2026-04-01: Report verified 2026-04-01: Fix ready for 2.0.0 2026-06-22: Fix backported to 1.11.x 2026-06-23: Fix released with 1.11.8 and 2.0.0rc3

Severity

4.6 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Impacted products

Name	purl
octoprint	pkg:pypi/octoprint

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "octoprint",
        "purl": "pkg:pypi/octoprint"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.8"
            },
            {
              "introduced": "2.0.0rc1"
            },
            {
              "fixed": "2.0.0rc3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.0",
        "1.10.0rc1",
        "1.10.0rc2",
        "1.10.0rc3",
        "1.10.0rc4",
        "1.10.1",
        "1.10.2",
        "1.10.3",
        "1.11.0",
        "1.11.0rc1",
        "1.11.0rc2",
        "1.11.0rc3",
        "1.11.0rc4",
        "1.11.0rc5",
        "1.11.0rc6",
        "1.11.0rc7",
        "1.11.1",
        "1.11.2",
        "1.11.3",
        "1.11.4",
        "1.11.5",
        "1.11.6",
        "1.11.7",
        "1.3.11",
        "1.3.12",
        "1.3.12rc1",
        "1.3.12rc3",
        "1.4.0",
        "1.4.0rc1",
        "1.4.0rc2",
        "1.4.0rc3",
        "1.4.0rc4",
        "1.4.0rc5",
        "1.4.0rc6",
        "1.4.1",
        "1.4.1rc1",
        "1.4.1rc2",
        "1.4.1rc3",
        "1.4.1rc4",
        "1.4.2",
        "1.5.0",
        "1.5.0rc1",
        "1.5.0rc2",
        "1.5.0rc3",
        "1.5.1",
        "1.5.2",
        "1.5.3",
        "1.6.0",
        "1.6.0rc1",
        "1.6.0rc2",
        "1.6.0rc3",
        "1.6.1",
        "1.7.0",
        "1.7.0rc1",
        "1.7.0rc2",
        "1.7.0rc3",
        "1.7.1",
        "1.7.2",
        "1.7.3",
        "1.8.0",
        "1.8.0rc1",
        "1.8.0rc2",
        "1.8.0rc3",
        "1.8.0rc4",
        "1.8.0rc5",
        "1.8.1",
        "1.8.2",
        "1.8.3",
        "1.8.4",
        "1.8.5",
        "1.8.6",
        "1.8.7",
        "1.9.0",
        "1.9.0rc1",
        "1.9.0rc2",
        "1.9.0rc3",
        "1.9.0rc4",
        "1.9.0rc5",
        "1.9.0rc6",
        "1.9.1",
        "1.9.2",
        "1.9.3",
        "2.0.0rc1",
        "2.0.0rc2"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35163",
    "GHSA-p6qx-ghxm-389h"
  ],
  "details": "### Impact\n\nOctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Suppressed Command notifications popups generated by the printer.\n\nAn attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance.\n\n### Patches\n\nThe vulnerability has been patched in version 1.11.8 and 2.0.0rc3.\n\n### Workaround\n\nOctoPrint administrators can mitigate the risk by disabling popups:\n- for Action Command notifications, set _OctoPrint Settings -\u003e Serial Connection -\u003e Behaviour -\u003e Sanity Checking -\u003e Display notifications for suppressed commands_ to _Never show notifications_\n\nIt is also strongly recommended to ensure that files being printed originate from trusted sources, and, whenever possible, are sliced with an application\u0027s own slicer.\n\n### Credits\n\nThis vulnerability was discovered and responsibly disclosed to OctoPrint by [Jacopo Tediosi](https://github.com/jacopotediosi).\n\n### Timeline\n\n2026-03-18: Report received\n2026-04-01: Report verified\n2026-04-01: Fix ready for 2.0.0\n2026-06-22: Fix backported to 1.11.x\n2026-06-23: Fix released with 1.11.8 and 2.0.0rc3",
  "id": "PYSEC-2026-2688",
  "modified": "2026-07-13T16:05:08.976434Z",
  "published": "2026-07-13T15:46:23.299816Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OctoPrint/OctoPrint"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/octoprint"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-p6qx-ghxm-389h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35163"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OctoPrint has XSS in its Suppressed Command Notifications"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-35163 (GCVE-0-2026-35163)

FKIE_CVE-2026-35163

GHSA-P6QX-GHXM-389H

Impact

Patches

Workaround

Credits

Timeline

PYSEC-2026-2688

Impact

Patches

Workaround

Credits

Timeline

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour