CVE-2026-123364
Deferred Deferred - Pending Action

Stored XSS in OctoPrint via Serial Connector Plugin

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: GitHub, Inc.

Description
OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-123364
EUVD
EUVD-2026-120120

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
octoprint octoprint From 2.0.0rc1 (inc) to 2.0.0rc6 (inc)
octoprint octoprint 2.0.0rc7
octoprint octoprint to 2.0.0rc7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OctoPrint versions 2.0.0rc1 through 2.0.0rc6. An authenticated user can inject malicious JavaScript via crafted default port or baudrate settings through the Serial Connector plugin API. These values are stored and later rendered unsafely in the web interface, allowing script execution in other users' browsers.

Detection Guidance

Check the OctoPrint config.yaml file for JavaScript fragments in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate settings. Look for any unusual or unexpected values in these fields that may contain script-like content.

Impact Analysis

An attacker with low privileges could execute arbitrary JavaScript in the context of other users' browsers. This could lead to session hijacking, unauthorized actions on behalf of users, or theft of sensitive data like printer settings or credentials. The impact is limited by the low CVSS score of 2.4.

Compliance Impact

This XSS vulnerability could potentially expose user data, which may impact compliance with GDPR (data protection) or HIPAA (privacy). Unauthorized script execution might lead to data breaches or unauthorized access, violating confidentiality requirements in these regulations.

Mitigation Strategies

Upgrade to OctoPrint version 2.0.0rc7 or later to patch the vulnerability. As a temporary measure, manually inspect and remove any JavaScript fragments from the printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate settings in the config.yaml file.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123364. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...