CVE-2023-41047: OctoPrint - Code Execution Vulnerability
Summary
CVE-2023-41047: OctoPrint is a web interface for 3D printers. Affects octoprint across 2 version ranges.
< 1.9.3
< d0072cff894509c77e243d6562245ad3079e17db
Fixed in d0072cff894509c77e243d6562245ad3079e17db. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OctoPrint is a popular web interface used for managing and controlling 3D printers. It provides a user-friendly interface for monitoring print jobs, adjusting printer settings, and interacting with the printer remotely. OctoPrint is widely used by hobbyists, professionals, and businesses in the 3D printing community. However, versions up until and including 1.9.2 of OctoPrint are vulnerable to a code execution vulnerability.
Vulnerability Detail
The vulnerability in OctoPrint versions up until 1.9.2 allows malicious administrators to configure a specially crafted GCODE script that can execute arbitrary code during the rendering process. This vulnerability can be exploited by an attacker to extract sensitive data managed by OctoPrint, manipulate the printer's data, or execute arbitrary commands with the privileges of the OctoPrint process on the server system. This poses a significant risk to the confidentiality, integrity, and availability of the OctoPrint instance and the underlying server.
How To Fix
Latest published version: 1.11.8 as of 22 Oct 2026
pip install --upgrade "octoprint==1.11.8"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
d0072cff894509c77e243d6562245ad3079e17db
This is the first release that contains the fix.
pip install --upgrade "octoprint==d0072cff894509c77e243d6562245ad3079e17db"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update OctoPrint to the patched version to mitigate the risk of exploitation.
Conclusion
The code execution vulnerability in OctoPrint versions up until 1.9.2 poses a significant risk to the security and functionality of OctoPrint instances. It is crucial for administrators to update to the patched version (1.9.3 or later) and exercise caution when configuring GCODE scripts. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for octoprint →
FAQ
OctoPrint is a web interface for managing and controlling 3D printers. It provides a user-friendly interface for monitoring print jobs, adjusting printer settings, and interacting with the printer remotely.
OctoPrint versions up until and including 1.9.2 are affected by this vulnerability. Versions 1.9.3 and later have been patched.
An attacker with malicious administrative access to an OctoPrint instance can configure a specially crafted GCODE script that triggers code execution during rendering. This allows the attacker to extract sensitive data, manipulate printer data, or execute arbitrary commands with the privileges of the OctoPrint process on the server system.
This vulnerability can lead to unauthorized access to sensitive data managed by OctoPrint, manipulation of printer data, and execution of arbitrary commands on the server system. It poses a significant risk to the confidentiality, integrity, and availability of the OctoPrint instance and the underlying server.
To protect your OctoPrint instance, ensure that you are running the latest patched version (1.9.3 or later) of OctoPrint. Additionally, exercise caution when configuring GCODE scripts and avoid using scripts from untrusted sources or third parties.
References
Related vulnerabilities
Recent vulnerabilities recorded for octoprint.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
