GHSA-p623-mxf7-qxjm

Suggest an improvement
Source
https://github.com/advisories/GHSA-p623-mxf7-qxjm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p623-mxf7-qxjm/GHSA-p623-mxf7-qxjm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-p623-mxf7-qxjm
Aliases
Published
2026-11-10T15:57:29Z
Modified
2026-11-10T16:15:04Z
Severity
  • 2.4 (Low) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N CVSS Calculator
Summary
OctoPrint: Stored XSS via saved connection parameters
Details

Impact

OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default port or baudrate setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a connect request.

Patches

The vulnerability is patched in 2.0.0rc7.

Workaround

Check config.yaml for Javascript fragments in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate. If found, remove them. You can check who of your users had access to your instance since you flashed 2.0.0rc1 or above via auth.log.

Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by "mahn-don".

Timeline

2026-10-14: Report received 2026-10-14: Report acknowledged 2026-10-14: Report verified 2026-10-14: Fix ready for 2.0.0rc7 2026-10-20: CVE requested

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-10T15:57:29Z",
    "nvd_published_at": "2026-11-09T17:17:27Z",
    "severity": "LOW"
}
References

Affected packages

PyPI / octoprint

Package

Name
octoprint
View open source insights on deps.dev
Purl
pkg:pypi/octoprint

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0rc1
Fixed
2.0.0rc7

Affected versions

2.*
2.0.0rc1
2.0.0rc2
2.0.0rc3
2.0.0rc4
2.0.0rc5
2.0.0rc6

Database specific

last_known_affected_version_range 
"<= 2.0.0rc6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p623-mxf7-qxjm/GHSA-p623-mxf7-qxjm.json"