---
id: CVE-2026-35163
title: OctoPrint provides a web interface for controlling consumer 3D printers
summary: >-
  OctoPrint provides a web interface for controlling consumer 3D printers. Prior
  to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify
  rendering for printer-controlled payload.command and payload.message values in
  src/…
severity: medium
cwe:
  - CWE-80
vendor: OctoPrint
product: OctoPrint
affected:
  - OctoPrint <= 1.11.7
  - 'OctoPrint >= 2.0.0rc1, <= 2.0.0rc2'
patched:
  - OctoPrint 1.11.8
  - OctoPrint 2.0.0rc3
published: '2026-08-21'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-35163'
references:
  - url: >-
      https://github.com/OctoPrint/OctoPrint/commit/42e0f9863935e136f04ed3c560cb96483a580d1b
    label: security-advisories@github.com
  - url: >-
      https://github.com/OctoPrint/OctoPrint/commit/6e3db9096f8a94f7c2249be24b6d03a7d9c12bc7
    label: security-advisories@github.com
  - url: 'https://github.com/OctoPrint/OctoPrint/releases/tag/1.11.8'
    label: security-advisories@github.com
  - url: 'https://github.com/OctoPrint/OctoPrint/releases/tag/2.0.0rc3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-p6qx-ghxm-389h
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-p6qx-ghxm-389h'
tags:
  - nvd
  - ghsa
  - pip
epss: 0.00199
epssPercentile: 0.08711
ecosystem: pip
ingestedAt: '2026-06-29T13:24:35.462Z'
---

## Overview

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML escaping. An attacker who convinces a victim to print a crafted file can inject HTML and JavaScript into the notification, disrupt prints, read information available to the victim including sensitive settings when permitted, or perform actions in the victim's OctoPrint session. This issue is fixed in versions 1.11.8 and 2.0.0rc3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-35163)

Affected packages:

- `OctoPrint <= 1.11.7`
- `OctoPrint >= 2.0.0rc1, <= 2.0.0rc2`

Patched in:

- `OctoPrint 1.11.8`
- `OctoPrint 2.0.0rc3`

Source: https://github.com/advisories/GHSA-p6qx-ghxm-389h