Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2022-1432: OctoPrint web page can run malicious code
CVE-2022-1432 · published 4 years ago
Summary
The OctoPrint web interface may allow attackers to insert harmful scripts that run in a user's browser. This could let them steal login details or change settings without permission. Update OctoPrint to version 1.8.0 or later, or apply the provided patches, to stop this risk.
What to do
- Update gina häußge octoprint to version 1.8.0.
- Update octoprint octoprint to version 1.8.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | gina häußge | octoprint |
< 1.8.0 Fix: upgrade to 1.8.0
|
| – | octoprint | octoprint |
< 1.8.0 cpe:2.3:a:octoprint:octoprint:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site Scripting (XSS) - Generic in octoprint/octoprint
Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0.
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-1432 Vendor Advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2022-2...
- https://github.com/advisories/GHSA-h8pc-j334-jjhm
- https://huntr.dev/bounties/cb545c63-a3c1-4d57-8f06-e4593ab389bf URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1432.j... Vendor Advisory
- https://github.com/octoprint/octoprint/commit/6d259d7e6f5b0de9a1c762831537a386e5... Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published18 May 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta