Is CVE-2026-35163 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35163 being exploited in the wild.

How severe is CVE-2026-35163?

Medium severity, with a CVSS score of 4, published 21 August 2026.

Which products and versions are affected?

OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.11.8, ECOSYSTEM:introduced=0,fixed=1.11.8,introduced=2.0.0rc1,fixed=2.0.0rc3.

Is there a fix for CVE-2026-35163?

Yes. OctoPrint (PyPI): upgrade to 1.11.8, 2.0.0rc3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35163 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-35163?

Check whether you run OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35163: OctoPrint XSS in Suppressed Command Notifications

CVE-2026-35163 · Severity: medium · CVSS 4 · Published 2026-08-21

OctoPrint, a popular web interface for 3D printers, is vulnerable to a security flaw in its notification system. An attacker can trick a user into printing a malicious file that executes unauthorized commands in the user's browser. This could allow the attacker to disrupt active 3D prints, steal sensitive configuration data, or perform actions as the logged-in user.

Technologies: OctoPrint (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-35163 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35163 being exploited in the wild.
How severe is CVE-2026-35163?: Medium severity, with a CVSS score of 4, published 21 August 2026.
Which products and versions are affected?: OctoPrint (PyPI) ECOSYSTEM:introduced=0,fixed=1.11.8, ECOSYSTEM:introduced=0,fixed=1.11.8,introduced=2.0.0rc1,fixed=2.0.0rc3.
Is there a fix for CVE-2026-35163?: Yes. OctoPrint (PyPI): upgrade to 1.11.8, 2.0.0rc3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35163 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-35163?: Check whether you run OctoPrint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

OctoPrint (PyPI): upgrade to 1.11.8, 2.0.0rc3 or later
```
pip install "OctoPrint>=2.0.0rc3"
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in OctoPrint's handling of Suppressed Command notifications. The root cause is improper neutralization of script-related HTML tags (CWE-80) in the notification popups generated by the printer. An attacker can exploit this by providing a specially crafted print file (G-code) containing malicious payloads. When a user attempts to print this file and a suppressed command notification is triggered, the malicious JavaScript executes in the context of the victim's session. This allows for session hijacking, information disclosure of configuration settings, and unauthorized control of the OctoPrint instance. The issue is fixed in versions 1.11.8 and 2.0.0rc3.

Affected products

OctoPrint OctoPrint <= 1.11.7, 2.0.0rc1, 2.0.0rc2

Identifiers

CVE-2026-35163
GHSA-p6qx-ghxm-389h
PYSEC-2026-2688

Timeline

2026-03-18: disclosed: Report received
2026-04-01: other: Report verified
2026-06-23: patched: Fix released in 1.11.8 and 2.0.0rc3
2026-06-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.