CVE-2022-1432: Cross-site Scripting (XSS) in octoprint/octoprint
Summary
CVE-2022-1432: Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. Affects octoprint across 2 version ranges.
< 1.8.0
< 6d259d7e6f5b0de9a1c762831537a386e53978d3
Fixed in 6d259d7e6f5b0de9a1c762831537a386e53978d3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OctoPrint is an open-source web interface for 3D printers. It provides a user-friendly interface to control and monitor 3D printing jobs. The octoprint/octoprint package, available on PyPI, is the official repository for OctoPrint. This vulnerability affects versions prior to 1.8.0.
Vulnerability Detail
The vulnerability identified as CVE-2022-1432 is a Cross-site Scripting (XSS) issue in the octoprint/octoprint repository. This vulnerability allows an attacker to inject malicious scripts into the OctoPrint web interface, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability was introduced in version 0 of the repository and was fixed in commit 6d259d7e6f5b0de9a1c762831537a386e53978d3. The fix was officially released in version 1.8.0 of the octoprint/octoprint package.
How To Fix
Latest published version: 1.11.8 as of 22 Oct 2026
pip install --upgrade "octoprint==1.11.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6d259d7e6f5b0de9a1c762831537a386e53978d3
This is the first release that contains the fix.
pip install --upgrade "octoprint==6d259d7e6f5b0de9a1c762831537a386e53978d3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The CVE-2022-1432 vulnerability in the octoprint/octoprint package is a Cross-site Scripting (XSS) issue that can potentially lead to unauthorized access and data theft. It is recommended to upgrade to version 1.8.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for octoprint →
FAQ
OctoPrint is an open-source web interface for 3D printers that allows users to control and monitor their 3D printing jobs.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The potential consequences of this vulnerability include unauthorized access to the OctoPrint web interface, data theft, and other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your version of OctoPrint is affected by this vulnerability.
You can find more information about this vulnerability in the advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/octoprint/PYSEC-2022-201.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for octoprint.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
