Cross-site scripting in OctoPrint - CVE-2024-28237
Published: March 18, 2024 / Updated: November 9, 2026
Vulnerability identifier: #VU162901
CSH Severity: Low
CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2024-28237
CWE-ID: CWE-79
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an administrator to execute JavaScript in another administrator's browser and access or modify sensitive OctoPrint settings.
The vulnerability exists due to improper neutralization of a malicious snapshot response content type in the Classic Webcam plugin when its Snapshot Test feature renders an image. An administrator can configure a crafted snapshot URL and induce the victim administrator to click Test, triggering the injected script.
Affected software
OctoPrint
How to mitigate CVE-2024-28237
Install security update from vendor's website.
OctoPrint - update to 1.10.0