CyberRota Analysis
AI-GeneratedOctoPrint versions prior to 1.11.8 and 2.0.0rc3 are vulnerable to HTML and JavaScript injection through the Suppressed Command notification popups, which do not properly escape user-controlled input. This vulnerability could allow an attacker to disrupt print jobs, access sensitive information, or execute unauthorized actions within the victim's OctoPrint session. Users of OctoPrint, particularly those managing 3D printing environments, should prioritize upgrading to the patched versions to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim's OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3.