Log in Start free

Vulnerability · Published Aug 21, 2026 · Assigned by GitHub_M

CVE-2026-35163OctoPrint: XSS in Suppressed Command Notifications

Medium 4.6

In plain English

A medium-severity security flaw in OctoPrint from OctoPrint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)4.6Medium
Exploit odds (30 days)0.2%top 90.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim's OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIoctoprint1.11.8GHSA-p6qx-ghxm-389h
PyPIoctoprint2.0.0rc3GHSA-p6qx-ghxm-389h
PyPIoctoprint1.11.8, 2.0.0rc3PYSEC-2026-2688

Affected products (as reported)

VendorProductVersions
OctoPrint OctoPrint < 1.11.8>= 2.0.0rc1, < 2.0.0rc3

Weakness: CWE-80 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

References