CVE-2021-32561: XSS vulnerability in OctoPrint
Summary
CVE-2021-32561: OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters. Affects octoprint versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OctoPrint is an open-source web interface for 3D printers that allows users to remotely control and monitor their printing process. It provides a user-friendly interface for managing print jobs, adjusting printer settings, and viewing real-time progress. OctoPrint is widely used by hobbyists, professionals, and educational institutions to streamline the 3D printing workflow.
Vulnerability Detail
The vulnerability identified as CVE-2021-32561 in OctoPrint versions prior to 1.6.0 is an XSS (Cross-Site Scripting) vulnerability. This vulnerability arises due to API error messages including the values of input parameters without proper sanitization. An attacker can exploit this vulnerability by injecting malicious scripts or HTML code into the input parameters, which will be executed when the error message is displayed to the user. This can lead to various consequences, including unauthorized access, data theft, and potential remote code execution.
How To Fix
Latest published version: 1.11.8 as of 22 Oct 2026
pip install --upgrade "octoprint==1.11.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.0
This is the first release that contains the fix.
pip install --upgrade "octoprint==1.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the display of API error messages in the OctoPrint web interface. This can be achieved by modifying the configuration settings to suppress error messages or by customizing the error handling mechanism to prevent the inclusion of input parameter values in the error responses. However, it is strongly recommended to upgrade to the latest version as soon as possible to fully mitigate the vulnerability.
Conclusion
In conclusion, the XSS vulnerability (CVE-2021-32561) in OctoPrint versions prior to 1.6.0 poses a significant security risk. It allows attackers to inject malicious scripts or HTML code, potentially leading to unauthorized access, data theft, and remote code execution. To mitigate this vulnerability, it is essential to upgrade OctoPrint to version 1.6.0 or later. Additionally, disabling the display of API error messages can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for octoprint →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or HTML code into web pages viewed by other users. It occurs when user input is not properly sanitized or validated, allowing the execution of arbitrary code in the context of the affected website.
An attacker can exploit this vulnerability by crafting malicious input parameters that contain JavaScript or HTML code. When the API error message is displayed, the injected code will be executed in the user's browser, potentially leading to unauthorized actions, data theft, or further exploitation of the system.
The consequences of this vulnerability can vary depending on the attacker's intentions and the security context of the affected system. Possible ramifications include unauthorized access to sensitive information, manipulation of printer settings, injection of malicious commands, and potential remote code execution.
Yes, the vulnerability has been fixed in OctoPrint version 1.6.0. It is strongly recommended to upgrade to this version or later to ensure the system is protected against potential XSS attacks.
There are no known instances of this vulnerability being actively exploited in the wild. However, it is crucial to apply the necessary security patches and upgrades to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for octoprint.
