Read the docs
TI-2024-18796 Aliases CVE-2024-28237GHSA-x7mf-wrh9-r76c

OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings

Priority MEDIUM 55CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to configure or talk a victim with administrator rights into configuring a webcam snapshot URL which when tested through the "Test" button included in the web interface will execute JavaScript code in the victims browser when attempting to render the snapshot image. An attacker who successfully talked a victim with admin rights into performing a snapshot test with such a crafted URL could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The vulnerability is patched in version 1.10.0rc3. OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation and what settings they modify based on instructions by strangers.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00435 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed OctoPrint (PyPI): 1.10.0rc3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OctoPrintOctoPrintup to 1.9.3—No fix listedCNA
—OctoPrint (PyPI)before 1.10.0rc31.10.0rc3Patch availableGHSA-x7mf-wrh9-r76c
  • OctoPrint VendorOctoPrint Affected up to 1.9.3 Fixed in — No fix listed CNA
  • OctoPrint (PyPI) Vendor— Affected before 1.10.0rc3 Fixed in 1.10.0rc3 Patch available GHSA-x7mf-wrh9-r76c

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:*before 1.10.0VulnerableOctoPrint
cpe:2.3:a:octoprint:octoprint:1.10.0:rc1:*:*:*:*:*:*1.10.0 rc1VulnerableOctoPrint
cpe:2.3:a:octoprint:octoprint:1.10.0:rc2:*:*:*:*:*:*1.10.0 rc2VulnerableOctoPrint
  • cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:* Versions before 1.10.0 Vulnerable ·OctoPrint
  • cpe:2.3:a:octoprint:octoprint:1.10.0:rc1:*:*:*:*:*:* Versions 1.10.0 rc1 Vulnerable ·OctoPrint
  • cpe:2.3:a:octoprint:octoprint:1.10.0:rc2:*:*:*:*:*:* Versions 1.10.0 rc2 Vulnerable ·OctoPrint

Remediation

  • Fix · GHSA-x7mf-wrh9-r76c OctoPrint (PyPI) Fixed in 1.10.0rc3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28237
  2. 2026-10-03 Alias added: GHSA-x7mf-wrh9-r76c

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2022-02830 Improper Privilege Management in octoprint/octoprint CVSS 3.1HIGH 8.8
  • TI-2022-03320 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint CVSS 3.1MEDIUM 6.0
  • TI-2022-02664 Unrestricted Upload of File with Dangerous Type in octoprint/octoprint CVSS 3.1MEDIUM 5.4
  • TI-2025-35988 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload CVSS 4.0HIGH 7.5
  • TI-2022-02678 Insufficient Session Expiration in octoprint/octoprint CVSS 3.1MEDIUM 4.4
  • TI-2024-21843 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled CVSS 3.1CRITICAL 9.4
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences