Executive brief
OctoPrint, a popular web interface for 3D printers, is vulnerable to a security flaw in its notification system. An attacker can trick a user into printing a malicious file that executes unauthorized commands in the user's browser. This could allow the attacker to disrupt active 3D prints, steal sensitive configuration data, or perform actions as the logged-in user.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in OctoPrint's handling of Suppressed Command notifications. The root cause is improper neutralization of script-related HTML tags (CWE-80) in the notification popups generated by the printer. An attacker can exploit this by providing a specially crafted print file (G-code) containing malicious payloads. When a user attempts to print this file and a suppressed command notification is triggered, the malicious JavaScript executes in the context of the victim's session. This allows for session hijacking, information disclosure of configuration settings, and unauthorized control of the OctoPrint instance. The issue is fixed in versions 1.11.8 and 2.0.0rc3.
Affected products
- OctoPrint OctoPrint <= 1.11.7, 2.0.0rc1, 2.0.0rc2
Timeline
- 2026-03-18: disclosed: Report received
- 2026-04-01: other: Report verified
- 2026-06-23: patched: Fix released in 1.11.8 and 2.0.0rc3
- 2026-06-23: advisory