CVE-2026-94490

Name of the Vulnerable Software and Affected Versions OctoPrint version 1.0.0

Description An OS command injection flaw exists in the Command API component within the executeSystemCommand() function of the src/octoprint/server/api/system.py file. A remote attacker can exploit this by manipulating the command argument to execute arbitrary operating system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the executeSystemCommand() function to minimize the risk of exploitation.