{"id":"GHSA-p623-mxf7-qxjm","summary":"OctoPrint: Stored XSS via saved connection parameters","details":"## Impact\n\nOctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default `port` or `baudrate` setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a `connect` request.\n\n## Patches\n\nThe vulnerability is patched in 2.0.0rc7.\n\n## Workaround\n\nCheck `config.yaml` for Javascript fragments in `printerConnection.preferred.parameters.port` or `printerConnection.preferred.parameters.baudrate`. If found, remove them. You can check who of your users had access to your instance since you flashed 2.0.0rc1 or above via `auth.log`. \n\n## Credits\n\nThis vulnerability was discovered and responsibly disclosed to OctoPrint by \"mahn-don\".\n\n## Timeline\n\n2026-10-14: Report received\n2026-10-14: Report acknowledged\n2026-10-14: Report verified\n2026-10-14: Fix ready for 2.0.0rc7\n2026-10-20: CVE requested","aliases":["CVE-2026-123364"],"modified":"2026-11-10T16:15:04.250261466Z","published":"2026-11-10T15:57:29Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-11-10T15:57:29Z","nvd_published_at":"2026-11-09T17:17:27Z","cwe_ids":["CWE-79"]},"references":[{"type":"WEB","url":"https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p623-mxf7-qxjm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123364"},{"type":"WEB","url":"https://github.com/OctoPrint/OctoPrint/commit/059495787a1086868a28ba9eca8d089729242646"},{"type":"PACKAGE","url":"https://github.com/OctoPrint/OctoPrint"},{"type":"WEB","url":"https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc7"}],"affected":[{"package":{"name":"octoprint","ecosystem":"PyPI","purl":"pkg:pypi/octoprint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0rc1"},{"fixed":"2.0.0rc7"}]}],"versions":["2.0.0rc1","2.0.0rc2","2.0.0rc3","2.0.0rc4","2.0.0rc5","2.0.0rc6"],"database_specific":{"last_known_affected_version_range":"\u003c= 2.0.0rc6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-p623-mxf7-qxjm/GHSA-p623-mxf7-qxjm.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N"}]}