Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in OctoPrint - CVE-2026-35163
Published: November 9, 2026
Vulnerability identifier: #VU162909
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-35163
CWE-ID: CWE-80
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript in an OctoPrint user's browser.
The vulnerability exists due to improper neutralization of HTML in printer-generated Suppressed Command notification popups triggered by a specially crafted print file when notifications are enabled. An unauthenticated attacker can convince a victim to print the file and then disrupt ongoing prints or extract sensitive configuration settings if the victim has permission to access them.
Affected software
OctoPrint
How to mitigate CVE-2026-35163
Install security update from vendor's website.
OctoPrint - addressed in versions 1.11.8, 2.0.0