{
  "affected": [
    {
      "affectedData": [
        {
          "product": "OctoPrint",
          "vendor": "OctoPrint",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.8"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0rc1, \u003c 2.0.0rc3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim\u0027s OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3."
    },
    {
      "lang": "es",
      "value": "OctoPrint proporciona una interfaz web para controlar impresoras 3D de consumo. Antes de las versiones 1.11.8 y 2.0.0rc3, las ventanas emergentes de notificaci\u00f3n de Comando Suprimido utilizan el renderizado de PNotify para los valores payload.command y payload.message controlados por la impresora en src/octoprint/static/js/app/viewmodels/terminal.js sin escape HTML. Un atacante que convence a una v\u00edctima para imprimir un archivo manipulado puede inyectar HTML y JavaScript en la notificaci\u00f3n, interrumpir impresiones, leer informaci\u00f3n disponible para la v\u00edctima, incluyendo configuraciones sensibles cuando est\u00e9 permitido, o realizar acciones en la sesi\u00f3n de OctoPrint de la v\u00edctima. Este problema est\u00e1 solucionado en las versiones 1.11.8 y 2.0.0rc3."
    }
  ],
  "id": "CVE-2026-35163",
  "lastModified": "2026-10-14T19:10:00.297",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-35163",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-21T19:53:45.594944Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-21T19:17:01.170",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OctoPrint/OctoPrint/commit/42e0f9863935e136f04ed3c560cb96483a580d1b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OctoPrint/OctoPrint/commit/6e3db9096f8a94f7c2249be24b6d03a7d9c12bc7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}