{"id":"CVE-2026-123364","aliases":["GHSA-p623-mxf7-qxjm"],"url":"https://o3.security/vulnerability/CVE-2026-123364","summary":"OctoPrint: Stored XSS via saved connection parameters","details":"## Impact\n\nOctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default `port` or `baudrate` setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a `connect` request.\n\n## Patches\n\nThe vulnerability is patched in 2.0.0rc7.\n\n## Workaround\n\nCheck `config.yaml` for Javascript fragments in `printerConnection.preferred.parameters.port` or `printerConnection.preferred.parameters.baudrate`. If found, remove them. You can check who of your users had access to your instance since you flashed 2.0.0rc1 or above via `auth.log`. \n\n## Credits\n\nThis vulnerability was discovered and responsibly disclosed to OctoPrint by \"mahn-don\".\n\n## Timeline\n\n2026-10-14: Report received\n2026-10-14: Report acknowledged\n2026-10-14: Report verified\n2026-10-14: Fix ready for 2.0.0rc7\n2026-10-20: CVE requested","published":"2026-11-09T17:10:35.399Z","modified":"2026-11-11T02:48:43.608829027Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"octoprint","fixedVersion":"2.0.0rc7"}],"fix":{"url":"https://github.com/OctoPrint/OctoPrint/commit/059495787a1086868a28ba9eca8d089729242646","label":"OctoPrint/OctoPrint@0594957"},"references":[{"type":"WEB","url":"https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123364.json"},{"type":"ADVISORY","url":"https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p623-mxf7-qxjm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123364"},{"type":"FIX","url":"https://github.com/OctoPrint/OctoPrint/commit/059495787a1086868a28ba9eca8d089729242646"},{"type":"PACKAGE","url":"https://github.com/OctoPrint/OctoPrint"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-11T02:48:43.608829027Z"}}