CVE-2022-1430: Cross-site Scripting (XSS) in octoprint
Summary
CVE-2022-1430: Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. Affects octoprint across 2 version ranges.
< 1.8.0
< 8087528e4a7ddd15c7d95ff662deb5ef7de90045
Fixed in 8087528e4a7ddd15c7d95ff662deb5ef7de90045. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OctoPrint is an open-source web interface for 3D printers that allows users to remotely control and monitor their printers. It provides a user-friendly interface for managing print jobs, adjusting printer settings, and viewing real-time status updates. The vulnerability identified as CVE-2022-1430 is a Cross-site Scripting (XSS) vulnerability in OctoPrint prior to version 1.8.0.
Vulnerability Detail
The XSS vulnerability in OctoPrint allows an attacker to inject malicious scripts into the web interface, which can be executed by unsuspecting users. This can lead to various security risks, such as stealing sensitive information, performing actions on behalf of the user, or manipulating the displayed content. The vulnerability originates from improper input sanitization and validation in the affected versions of OctoPrint.
How To Fix
Latest published version: 1.11.8 as of 22 Oct 2026
pip install --upgrade "octoprint==1.11.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8087528e4a7ddd15c7d95ff662deb5ef7de90045
This is the first release that contains the fix.
pip install --upgrade "octoprint==8087528e4a7ddd15c7d95ff662deb5ef7de90045"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, users can implement a temporary workaround by disabling the affected functionality or implementing additional security measures. For example, disabling user-generated content or implementing Content Security Policy (CSP) rules can help mitigate the risk of XSS attacks. However, these workarounds may limit certain features or functionalities of OctoPrint.
Conclusion
The XSS vulnerability in OctoPrint prior to version 1.8.0 poses a significant security risk to users, potentially leading to unauthorized access, data theft, or manipulation of printer settings. It is crucial to update OctoPrint to the latest version and regularly apply software updates to protect against such vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for octoprint →
FAQ
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate content, or perform actions on behalf of the user.
The XSS vulnerability in OctoPrint can be exploited by an attacker who can trick a user into visiting a specially crafted web page or clicking on a malicious link. Once the user interacts with the compromised OctoPrint interface, the injected script can execute within the user's browser context.
The potential consequences of this vulnerability include unauthorized access to sensitive information, manipulation of printer settings or print jobs, and the ability to perform actions on behalf of the user. This can lead to privacy breaches, compromised print quality, or even physical damage to the printer.
No, only versions of OctoPrint prior to 1.8.0 are affected by this XSS vulnerability. It is crucial to update to the latest version to ensure the security of the OctoPrint installation.
At the time of this advisory, there is no evidence of active exploitation of this vulnerability. However, it is essential to promptly update OctoPrint to the latest version to mitigate the risk of potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for octoprint.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
