PT-2026-140455

CVE-2026-123364

Published

2026-11-09

Updated

2026-11-10

Description by

CVSS 4.0

2.4

Low

MetricsAV:A/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions OctoPrint versions 2.0.0rc1 through 2.0.0rc6

Description An authenticated user can provide a crafted default port or baudrate via a connect request to the bundled Serial Connector plugin. The software stores these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters. This allows for script execution in the viewing user's browser and unauthorized actions within their OctoPrint access.

Recommendations Update to version 2.0.0rc7.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-123364