Vulnerability GHSA-p623-mxf7-qxjm
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
12 hours ago
November 10, 2026 at 03:57 PM UTC
OctoPrint: Stored XSS via saved connection parameters
2.0.0rc1 and 2.0.0rc2 and 2.0.0rc3 and 2.0.0rc4 and 2.0.0rc5 and 2.0.0rc6
2.0.0rc1 and 2.0.0rc2 and 2.0.0rc3 and 2.0.0rc4 and 2.0.0rc5 and 2.0.0rc6
Summary
OctoPrint: Stored XSS via saved connection parameters
Details
Impact
OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default port or baudrate setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a connect request.
Patches
The vulnerability is patched in 2.0.0rc7.
Workaround
Check config.yaml for Javascript fragments in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate. If found, remove them. You can check who of your users had access to your instance since you flashed 2.0.0rc1 or above via auth.log.
Credits
This vulnerability was discovered and responsibly disclosed to OctoPrint by "mahn-don".
Timeline
2026-10-14: Report received 2026-10-14: Report acknowledged 2026-10-14: Report verified 2026-10-14: Fix ready for 2.0.0rc7 2026-10-20: CVE requested
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
4 months ago
OctoPrint has possible file exfiltration via query parameters on upload endpoints
1.3.11 - 1.3.12rc1 and 1.3.12rc3 and 1.3.12 - 1.4.0rc1 and 1.4.0rc2 and 1.4.0rc3 and 1.4.0rc4 and 1.4.0rc5 and 1.4.0rc6 and 1.4.0 - 1.4.1rc1 and 1.4.1rc2 and 1.4.1rc3 and 1.4.1rc4 and 1.4.1 - 1.5.0rc1 and 1.5.0rc2 and 1.5.0rc3 and 1.5.0 - 1.6.0rc1 and 1.6.0rc2 and 1.6.0rc3 and 1.6.0 - 1.7.0rc1 and 1.7.0rc2 and 1.7.0rc3 and 1.7.0 - 1.8.0rc1 and 1.8.0rc2 and 1.8.0rc3 and 1.8.0rc4 and 1.8.0rc5 and 1.8.0 - 1.9.0rc1 and 1.9.0rc2 and 1.9.0rc3 and 1.9.0rc4 and 1.9.0rc5 and 1.9.0rc6 and 1.9.0 - 1.10.0rc1 and 1.10.0rc2 and 1.10.0rc3 and 1.10.0rc4 and 1.10.0 - 1.11.0rc1 and 1.11.0rc2 and 1.11.0rc3 and 1.11.0rc4 and 1.11.0rc5 and 1.11.0rc6 and 1.11.0rc7 and 1.11.0 - 2.0.0rc1 and 2.0.0rc2 PYSEC-2026-2687
1.3.11 - 1.3.12rc1 and 1.3.12rc3 and 1.3.12 - 1.4.0rc1 and 1.4.0rc2 and 1.4.0rc3 and 1.4.0rc4 and 1.4.0rc5 and 1.4.0rc6 and 1.4.0 - 1.4.1rc1 and 1.4.1rc2 and 1.4.1rc3 and 1.4.1rc4 and 1.4.1 - 1.5.0rc1 and 1.5.0rc2 and 1.5.0rc3 and 1.5.0 - 1.6.0rc1 and 1.6.0rc2 and 1.6.0rc3 and 1.6.0 - 1.7.0rc1 and 1.7.0rc2 and 1.7.0rc3 and 1.7.0 - 1.8.0rc1 and 1.8.0rc2 and 1.8.0rc3 and 1.8.0rc4 and 1.8.0rc5 and 1.8.0 - 1.9.0rc1 and 1.9.0rc2 and 1.9.0rc3 and 1.9.0rc4 and 1.9.0rc5 and 1.9.0rc6 and 1.9.0 - 1.10.0rc1 and 1.10.0rc2 and 1.10.0rc3 and 1.10.0rc4 and 1.10.0 - 1.11.0rc1 and 1.11.0rc2 and 1.11.0rc3 and 1.11.0rc4 and 1.11.0rc5 and 1.11.0rc6 and 1.11.0rc7 and 1.11.0 - 2.0.0rc1 and 2.0.0rc2 PYSEC-2026-2687
Unknown
4 months ago
OctoPrint has XSS in its Suppressed Command Notifications
1.3.11 - 1.3.12rc1 and 1.3.12rc3 and 1.3.12 - 1.4.0rc1 and 1.4.0rc2 and 1.4.0rc3 and 1.4.0rc4 and 1.4.0rc5 and 1.4.0rc6 and 1.4.0 - 1.4.1rc1 and 1.4.1rc2 and 1.4.1rc3 and 1.4.1rc4 and 1.4.1 - 1.5.0rc1 and 1.5.0rc2 and 1.5.0rc3 and 1.5.0 - 1.6.0rc1 and 1.6.0rc2 and 1.6.0rc3 and 1.6.0 - 1.7.0rc1 and 1.7.0rc2 and 1.7.0rc3 and 1.7.0 - 1.8.0rc1 and 1.8.0rc2 and 1.8.0rc3 and 1.8.0rc4 and 1.8.0rc5 and 1.8.0 - 1.9.0rc1 and 1.9.0rc2 and 1.9.0rc3 and 1.9.0rc4 and 1.9.0rc5 and 1.9.0rc6 and 1.9.0 - 1.10.0rc1 and 1.10.0rc2 and 1.10.0rc3 and 1.10.0rc4 and 1.10.0 - 1.11.0rc1 and 1.11.0rc2 and 1.11.0rc3 and 1.11.0rc4 and 1.11.0rc5 and 1.11.0rc6 and 1.11.0rc7 and 1.11.0 - 2.0.0rc1 and 2.0.0rc2 PYSEC-2026-2688
1.3.11 - 1.3.12rc1 and 1.3.12rc3 and 1.3.12 - 1.4.0rc1 and 1.4.0rc2 and 1.4.0rc3 and 1.4.0rc4 and 1.4.0rc5 and 1.4.0rc6 and 1.4.0 - 1.4.1rc1 and 1.4.1rc2 and 1.4.1rc3 and 1.4.1rc4 and 1.4.1 - 1.5.0rc1 and 1.5.0rc2 and 1.5.0rc3 and 1.5.0 - 1.6.0rc1 and 1.6.0rc2 and 1.6.0rc3 and 1.6.0 - 1.7.0rc1 and 1.7.0rc2 and 1.7.0rc3 and 1.7.0 - 1.8.0rc1 and 1.8.0rc2 and 1.8.0rc3 and 1.8.0rc4 and 1.8.0rc5 and 1.8.0 - 1.9.0rc1 and 1.9.0rc2 and 1.9.0rc3 and 1.9.0rc4 and 1.9.0rc5 and 1.9.0rc6 and 1.9.0 - 1.10.0rc1 and 1.10.0rc2 and 1.10.0rc3 and 1.10.0rc4 and 1.10.0 - 1.11.0rc1 and 1.11.0rc2 and 1.11.0rc3 and 1.11.0rc4 and 1.11.0rc5 and 1.11.0rc6 and 1.11.0rc7 and 1.11.0 - 2.0.0rc1 and 2.0.0rc2 PYSEC-2026-2688
Medium Risk
4 months ago
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
1.3.11 - 1.3.12rc1 and 1.3.12rc3 and 1.3.12 - 1.4.0rc1 and 1.4.0rc2 and 1.4.0rc3 and 1.4.0rc4 and 1.4.0rc5 and 1.4.0rc6 and 1.4.0 - 1.4.1rc1 and 1.4.1rc2 and 1.4.1rc3 and 1.4.1rc4 and 1.4.1 - 1.5.0rc1 and 1.5.0rc2 and 1.5.0rc3 and 1.5.0 - 1.6.0rc1 and 1.6.0rc2 and 1.6.0rc3 and 1.6.0 - 1.7.0rc1 and 1.7.0rc2 and 1.7.0rc3 and 1.7.0 - 1.8.0rc1 and 1.8.0rc2 and 1.8.0rc3 and 1.8.0rc4 and 1.8.0rc5 and 1.8.0 - 1.9.0rc1 and 1.9.0rc2 and 1.9.0rc3 and 1.9.0rc4 and 1.9.0rc5 and 1.9.0rc6 and 1.9.0 - 1.10.0rc1 and 1.10.0rc2 and 1.10.0rc3 and 1.10.0rc4 and 1.10.0 - 1.11.0rc1 and 1.11.0rc2 and 1.11.0rc3 and 1.11.0rc4 and 1.11.0rc5 and 1.11.0rc6 and 1.11.0rc7 and 1.11.0 - 1.11.5 PYSEC-2026-1716
1.3.11 - 1.3.12rc1 and 1.3.12rc3 and 1.3.12 - 1.4.0rc1 and 1.4.0rc2 and 1.4.0rc3 and 1.4.0rc4 and 1.4.0rc5 and 1.4.0rc6 and 1.4.0 - 1.4.1rc1 and 1.4.1rc2 and 1.4.1rc3 and 1.4.1rc4 and 1.4.1 - 1.5.0rc1 and 1.5.0rc2 and 1.5.0rc3 and 1.5.0 - 1.6.0rc1 and 1.6.0rc2 and 1.6.0rc3 and 1.6.0 - 1.7.0rc1 and 1.7.0rc2 and 1.7.0rc3 and 1.7.0 - 1.8.0rc1 and 1.8.0rc2 and 1.8.0rc3 and 1.8.0rc4 and 1.8.0rc5 and 1.8.0 - 1.9.0rc1 and 1.9.0rc2 and 1.9.0rc3 and 1.9.0rc4 and 1.9.0rc5 and 1.9.0rc6 and 1.9.0 - 1.10.0rc1 and 1.10.0rc2 and 1.10.0rc3 and 1.10.0rc4 and 1.10.0 - 1.11.0rc1 and 1.11.0rc2 and 1.11.0rc3 and 1.11.0rc4 and 1.11.0rc5 and 1.11.0rc6 and 1.11.0rc7 and 1.11.0 - 1.11.5 PYSEC-2026-1716
Unknown
4 months ago
OctoPrint vulnerable to XSS in Action Commands Notification and Prompt
1.3.11 - 1.3.12rc1 and 1.3.12rc3 and 1.3.12 - 1.4.0rc1 and 1.4.0rc2 and 1.4.0rc3 and 1.4.0rc4 and 1.4.0rc5 and 1.4.0rc6 and 1.4.0 - 1.4.1rc1 and 1.4.1rc2 and 1.4.1rc3 and 1.4.1rc4 and 1.4.1 - 1.5.0rc1 and 1.5.0rc2 and 1.5.0rc3 and 1.5.0 - 1.6.0rc1 and 1.6.0rc2 and 1.6.0rc3 and 1.6.0 - 1.7.0rc1 and 1.7.0rc2 and 1.7.0rc3 and 1.7.0 - 1.8.0rc1 and 1.8.0rc2 and 1.8.0rc3 and 1.8.0rc4 and 1.8.0rc5 and 1.8.0 - 1.9.0rc1 and 1.9.0rc2 and 1.9.0rc3 and 1.9.0rc4 and 1.9.0rc5 and 1.9.0rc6 and 1.9.0 - 1.10.0rc1 and 1.10.0rc2 and 1.10.0rc3 and 1.10.0rc4 and 1.10.0 - 1.11.0rc1 and 1.11.0rc2 and 1.11.0rc3 and 1.11.0rc4 and 1.11.0rc5 and 1.11.0rc6 and 1.11.0rc7 and 1.11.0 - 1.11.3 PYSEC-2026-1714
1.3.11 - 1.3.12rc1 and 1.3.12rc3 and 1.3.12 - 1.4.0rc1 and 1.4.0rc2 and 1.4.0rc3 and 1.4.0rc4 and 1.4.0rc5 and 1.4.0rc6 and 1.4.0 - 1.4.1rc1 and 1.4.1rc2 and 1.4.1rc3 and 1.4.1rc4 and 1.4.1 - 1.5.0rc1 and 1.5.0rc2 and 1.5.0rc3 and 1.5.0 - 1.6.0rc1 and 1.6.0rc2 and 1.6.0rc3 and 1.6.0 - 1.7.0rc1 and 1.7.0rc2 and 1.7.0rc3 and 1.7.0 - 1.8.0rc1 and 1.8.0rc2 and 1.8.0rc3 and 1.8.0rc4 and 1.8.0rc5 and 1.8.0 - 1.9.0rc1 and 1.9.0rc2 and 1.9.0rc3 and 1.9.0rc4 and 1.9.0rc5 and 1.9.0rc6 and 1.9.0 - 1.10.0rc1 and 1.10.0rc2 and 1.10.0rc3 and 1.10.0rc4 and 1.10.0 - 1.11.0rc1 and 1.11.0rc2 and 1.11.0rc3 and 1.11.0rc4 and 1.11.0rc5 and 1.11.0rc6 and 1.11.0rc7 and 1.11.0 - 1.11.3 PYSEC-2026-1714
High Risk
4 months ago
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
1.3.11 - 1.3.12rc1 and 1.3.12rc3 and 1.3.12 - 1.4.0rc1 and 1.4.0rc2 and 1.4.0rc3 and 1.4.0rc4 and 1.4.0rc5 and 1.4.0rc6 and 1.4.0 - 1.4.1rc1 and 1.4.1rc2 and 1.4.1rc3 and 1.4.1rc4 and 1.4.1 - 1.5.0rc1 and 1.5.0rc2 and 1.5.0rc3 and 1.5.0 - 1.6.0rc1 and 1.6.0rc2 and 1.6.0rc3 and 1.6.0 - 1.7.0rc1 and 1.7.0rc2 and 1.7.0rc3 and 1.7.0 - 1.8.0rc1 and 1.8.0rc2 and 1.8.0rc3 and 1.8.0rc4 and 1.8.0rc5 and 1.8.0 - 1.9.0rc1 and 1.9.0rc2 and 1.9.0rc3 and 1.9.0rc4 and 1.9.0rc5 and 1.9.0rc6 and 1.9.0 - 1.10.0rc1 and 1.10.0rc2 and 1.10.0rc3 and 1.10.0rc4 and 1.10.0 - 1.11.0rc1 and 1.11.0rc2 and 1.11.0rc3 and 1.11.0rc4 and 1.11.0rc5 and 1.11.0rc6 and 1.11.0rc7 and 1.11.0 - 1.11.2 PYSEC-2026-1712
1.3.11 - 1.3.12rc1 and 1.3.12rc3 and 1.3.12 - 1.4.0rc1 and 1.4.0rc2 and 1.4.0rc3 and 1.4.0rc4 and 1.4.0rc5 and 1.4.0rc6 and 1.4.0 - 1.4.1rc1 and 1.4.1rc2 and 1.4.1rc3 and 1.4.1rc4 and 1.4.1 - 1.5.0rc1 and 1.5.0rc2 and 1.5.0rc3 and 1.5.0 - 1.6.0rc1 and 1.6.0rc2 and 1.6.0rc3 and 1.6.0 - 1.7.0rc1 and 1.7.0rc2 and 1.7.0rc3 and 1.7.0 - 1.8.0rc1 and 1.8.0rc2 and 1.8.0rc3 and 1.8.0rc4 and 1.8.0rc5 and 1.8.0 - 1.9.0rc1 and 1.9.0rc2 and 1.9.0rc3 and 1.9.0rc4 and 1.9.0rc5 and 1.9.0rc6 and 1.9.0 - 1.10.0rc1 and 1.10.0rc2 and 1.10.0rc3 and 1.10.0rc4 and 1.10.0 - 1.11.0rc1 and 1.11.0rc2 and 1.11.0rc3 and 1.11.0rc4 and 1.11.0rc5 and 1.11.0rc6 and 1.11.0rc7 and 1.11.0 - 1.11.2 PYSEC-2026-1712
Impacted packages
Timeline
Published
12 hours ago
November 10, 2026 at 03:57 PM UTC
Last Modified
12 hours ago
November 10, 2026 at 04:15 PM UTC