TI-2025-39630 Aliases CVE-2025-64187 GHSA-crvm-xjhm-9h29

OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts

LOW 20CWE-80Published 2025-11-07 · Updated 2025-11-07

Key facts

Attack vector: Local
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-80.

Summary

OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. This issue is fixed in version 1.11.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00169 6th percentileScored 2026-11-08

Fix Fixed OctoPrint (OctoPrint): 1.11.4octoprint (PyPI): 1.11.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OctoPrint	OctoPrint	before 1.11.4	1.11.4	Patch available	CNA
—	octoprint (PyPI)	before 1.11.4	1.11.4	Patch available	GHSA-crvm-xjhm-9h29

OctoPrint VendorOctoPrint Affected before 1.11.4 Fixed in 1.11.4 Patch available CNA
octoprint (PyPI) Vendor— Affected before 1.11.4 Fixed in 1.11.4 Patch available GHSA-crvm-xjhm-9h29

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:octoprint:octoprint::::::::	before 1.11.4	Vulnerable	OctoPrint

cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:* Versions before 1.11.4 Vulnerable ·OctoPrint

Remediation

Fix · CNA OctoPrint (OctoPrint) Fixed in 1.11.4
Fix · GHSA-crvm-xjhm-9h29 octoprint (PyPI) Fixed in 1.11.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-64187
2026-10-03 Alias added: GHSA-crvm-xjhm-9h29

References

Patch 1

https://github.com/OctoPrint/OctoPrint/commit/9112e07b1085f4c1ee9eefc67985809251057a44

Advisory 2

Other 1

https://github.com/OctoPrint/OctoPrint

TI-2022-02830 Improper Privilege Management in octoprint/octoprint CVSS 3.1HIGH 8.8
TI-2022-03320 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint CVSS 3.1MEDIUM 6.0
TI-2022-02664 Unrestricted Upload of File with Dangerous Type in octoprint/octoprint CVSS 3.1MEDIUM 5.4
TI-2025-35988 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload CVSS 4.0HIGH 7.5
TI-2024-18796 OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings CVSS 3.1MEDIUM 4.8
TI-2022-02678 Insufficient Session Expiration in octoprint/octoprint CVSS 3.1MEDIUM 4.4

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences