CVE-2026-35163mediumCWE-80

CVE-2026-35163: medium-severity vulnerability in OctoPrint

OctoPrint: XSS in Suppressed Command Notifications

Published

Follow this CVE+ Monitor OctoPrint+ Monitor octoprint

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.6epss 0.2%
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim's OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N
Affected products
OctoPrint · OctoPrint
Related CVEs — OctoPrint

In the same product, most dangerous first.

CVE-2025-58180HIGHOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File UploadEPSS 22.1%CVE-2024-32977HIGHOctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabledEPSS 0.9%CVE-2023-41047MEDIUMImproper Neutralization of Special Elements Used in a Template Engine in OctoPrintEPSS 0.6%CVE-2024-23637MEDIUMOctoPrint Unverified Password Change via Access Control SettingsEPSS 0.5%CVE-2024-28237MEDIUMOctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settingsEPSS 0.4%CVE-2026-23892MEDIUMOctoPrint has Timing Side-Channel Vulnerability in API Key AuthenticationEPSS 0.4%