---
id: "CVE-2026-123364"
page: "https://infrastack.ai/live/CVE-2026-123364"
kind: "vulnerability"
aliases: ["CVE-2026-123364"]
title: "OctoPrint: saved serial connection parameters allow stored script execution in browsers"
severity: "low"
cvss: 2.4
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "OctoPrint", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["3d-printing", "octoprint", "other", "self-hosted", "serial-connector"]
not_affected_if: ["default-config", "single-user"]
published_at: "2026-11-09T17:17:27+00:00"
first_seen_at: "2026-11-09T17:27:39+00:00"
updated_at: "2026-11-09T17:29:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123364", "first_seen_at": "2026-11-09T17:27:39+00:00"}]
exploit_sources: []
---

# OctoPrint: saved serial connection parameters allow stored script execution in browsers

Link for people: https://infrastack.ai/live/CVE-2026-123364 (this .md is for agents)

An authenticated OctoPrint user can save a crafted default port or baudrate through the Serial Connector plugin, and OctoPrint renders it unescaped as HTML. When another user views the saved connection parameters, the script runs in their browser with their OctoPrint access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OctoPrint affected range not listed fixed no fixed version listed

## How to check

- Check the installed OctoPrint version (`octoprint --version` or the version shown in Settings) and see whether it is between `2.0.0rc1` and `2.0.0rc6`.
- Confirm whether the bundled Serial Connector plugin is in use for printer connections.

## Fix

- Move to OctoPrint `2.0.0rc7` or later.

## Timeline

- 2026-11-09T17:27:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123364

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p623-mxf7-qxjm
- [fix] Patch: github.com https://github.com/OctoPrint/OctoPrint/commit/059495787a1086868a28ba9eca8d089729242646
- [fix] Release notes: github.com https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc7

## From the sources

OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_