CVE-2025-64187 OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts
Attackers can inject malicious scripts via crafted print files, allowing them to execute code or steal data from the OctoPrint web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-64187?
CVE-2025-64187 is a medium-severity cross-site scripting vulnerability in OctoPrint, published on 7 Nov 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. This issue is fixed in version 1.11.4.
Weakness: CWE-80
Which versions are affected by CVE-2025-64187?
3 open source packages ship an affected version, including octoprint. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
octoprint PyPI | All versions | 1.11.4 |
octoprint PyPI | All versions | 1.11.4 |
octoprint PyPI | All versions | 1.11.4 |
Products include Octoprint Octoprint.
How do I fix CVE-2025-64187?
Upgrade octoprint to 1.11.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-64187 being exploited?
There is no known exploitation of CVE-2025-64187 in the wild and no public exploit code.
Other vulnerabilities in OctoPrint
- CVE-2018-16710 Information disclosure in n/a
- CVE-2025-58180 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
- CVE-2022-1430 Cross-site Scripting (XSS) - DOM in octoprint/octoprint
- CVE-2022-1432 Cross-site Scripting (XSS) - Generic in octoprint/octoprint
- CVE-2024-32977 OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled
Sources
Also known as GHSA-crvm-xjhm-9h29, PYSEC-2026-1714.