{"id":"CVE-2026-123364","kind":"vulnerability","aliases":["CVE-2026-123364"],"related":[],"title":"OctoPrint: saved serial connection parameters allow stored script execution in browsers","description":"OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7.","summary":"An authenticated OctoPrint user can save a crafted default port or baudrate through the Serial Connector plugin, and OctoPrint renders it unescaped as HTML. When another user views the saved connection parameters, the script runs in their browser with their OctoPrint access.","severity":"low","cvss":2.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OctoPrint","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["3d-printing","octoprint","other","self-hosted","serial-connector"],"not_affected_if":["default-config","single-user"],"how_to_check":"- Check the installed OctoPrint version (`octoprint --version` or the version shown in Settings) and see whether it is between `2.0.0rc1` and `2.0.0rc6`.\n- Confirm whether the bundled Serial Connector plugin is in use for printer connections.","fix":"- Move to OctoPrint `2.0.0rc7` or later.","status":"open","published_at":"2026-11-09T17:17:27+00:00","first_seen_at":"2026-11-09T17:27:39+00:00","triaged_at":"2026-11-09T17:29:00+00:00","updated_at":"2026-11-09T17:29:00+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-09T17:29:00Z","model":"claude-haiku-5-5","output":{"fix":"- Move to OctoPrint `2.0.0rc7` or later.","reach":"network","title":"OctoPrint: saved serial connection parameters allow stored script execution in browsers","impact":"medium","summary":"An authenticated OctoPrint user can save a crafted default port or baudrate through the Serial Connector plugin, and OctoPrint renders it unescaped as HTML. When another user views the saved connection parameters, the script runs in their browser with their OctoPrint access.","audience":"businesses","category":"other","nicknames":[],"who_cares":["octoprint","self-hosted","3d-printing","serial-connector"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in another user's browser with their OctoPrint access","analyst_note":"","how_to_check":"- Check the installed OctoPrint version (`octoprint --version` or the version shown in Settings) and see whether it is between `2.0.0rc1` and `2.0.0rc6`.\n- Confirm whether the bundled Serial Connector plugin is in use for printer connections.","plain_action":"","product_name":"OctoPrint","needs_analyst":false,"not_affected_if":["single-user","default-config"],"who_is_affected":"Exposure requires an OctoPrint instance in the 2.0.0rc1 to 2.0.0rc6 range where the Serial Connector plugin handles connect requests. Any user with an account can plant the payload, so the risk is highest on shared print servers with several users. Single-user installs with no other accounts are lower risk.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000763,"input_tokens":4680,"output_tokens":589,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123364':14A,17A '-2026':13A,16A '2.0.0':83C,86C,152C '3d':20B,80C '3d-printing':19B 'access':71B,145C 'action':139C 'allow':6A,130C 'anoth':55B,123C 'authent':31B,89C 'baudrat':41B,98C 'browser':11A,67B,137C 'bundl':105C 'connect':4A,60B,101C,128C 'connector':29B,45B,107C 'consum':79C 'control':78C 'craft':37B,94C 'cve':12A,15A 'default':38B,95C 'execut':9A,132C 'fix':149C 'host':26B 'html':53B,121C 'interfac':76C 'issu':147C 'octoprint':1A,18A,22B,32B,48B,70B,72C,109C,144C 'paramet':5A,61B,129C 'persist':110C 'plugin':46B,108C 'port':39B,96C 'print':21B 'printer':81C 'printerconnection.preferred.parameters.baudrate':116C 'printerconnection.preferred.parameters.port':114C 'provid':73C 'rc1':84C 'rc7':87C,153C 'render':49B,118C 'request':102C 'run':64B 'save':2A,35B,59B,127C 'script':8A,63B,131C 'self':25B 'self-host':24B 'serial':3A,28B,44B,106C 'serial-connector':27B 'store':7A 'suppli':92C 'unescap':51B 'user':33B,56B,90C,124C,135C,142C 'valu':112C 'version':151C 'view':57B,125C 'web':75C 'within':140C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires an OctoPrint instance in the 2.0.0rc1 to 2.0.0rc6 range where the Serial Connector plugin handles connect requests. Any user with an account can plant the payload, so the risk is highest on shared print servers with several users. Single-user installs with no other accounts are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["octoprint"],"ptokens":["octoprint"],"labels":["3dprinting","low","octoprint","other","selfhosted","serialconnector","vendor"],"campaign_type":null,"search_a":"'-123364':14A,17A '-2026':13A,16A 'allow':6A 'browser':11A 'connect':4A 'cve':12A,15A 'execut':9A 'octoprint':1A,18A 'paramet':5A 'save':2A 'script':8A 'serial':3A 'store':7A","search_b":"'3d':20B '3d-printing':19B 'access':71B 'anoth':55B 'authent':31B 'baudrat':41B 'browser':67B 'connect':60B 'connector':29B,45B 'craft':37B 'default':38B 'host':26B 'html':53B 'octoprint':22B,32B,48B,70B 'paramet':61B 'plugin':46B 'port':39B 'print':21B 'render':49B 'run':64B 'save':35B,59B 'script':63B 'self':25B 'self-host':24B 'serial':28B,44B 'serial-connector':27B 'unescap':51B 'user':33B,56B 'view':57B","search_c":"'2.0.0':83C,86C,152C '3d':80C 'access':145C 'action':139C 'allow':130C 'anoth':123C 'authent':89C 'baudrat':98C 'browser':137C 'bundl':105C 'connect':101C,128C 'connector':107C 'consum':79C 'control':78C 'craft':94C 'default':95C 'execut':132C 'fix':149C 'html':121C 'interfac':76C 'issu':147C 'octoprint':72C,109C,144C 'paramet':129C 'persist':110C 'plugin':108C 'port':96C 'printer':81C 'printerconnection.preferred.parameters.baudrate':116C 'printerconnection.preferred.parameters.port':114C 'provid':73C 'rc1':84C 'rc7':87C,153C 'render':118C 'request':102C 'save':127C 'script':131C 'serial':106C 'suppli':92C 'user':90C,124C,135C,142C 'valu':112C 'version':151C 'view':125C 'web':75C 'within':140C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-20T11:00:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123364","severity":null,"published_at":"2026-11-09T17:17:27+00:00","modified_at":"2026-11-09T17:17:27+00:00","first_seen_at":"2026-11-09T17:27:39+00:00","fetched_at":"2026-11-09T17:27:39+00:00","note":null}],"documents":[{"id":108522,"url":"https://github.com/OctoPrint/OctoPrint/commit/059495787a1086868a28ba9eca8d089729242646","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108523,"url":"https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc7","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":108524,"url":"https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p623-mxf7-qxjm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-20T11:00:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}