What is GHSA-p623-mxf7-qxjm?

GHSA-p623-mxf7-qxjm is a security advisory published by GitHub Security Advisories with Low severity. OctoPrint: Stored XSS via saved connection parameters

Which CVE IDs does GHSA-p623-mxf7-qxjm cover?

GHSA-p623-mxf7-qxjm covers the following CVE IDs: CVE-2026-123364. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-p623-mxf7-qxjm?

GHSA-p623-mxf7-qxjm affects 1 product, including: pip/OctoPrint:\u003e= 2.0.0rc1, \u003c= 2.0.0rc6.

GHSA-p623-mxf7-qxjmLow

OctoPrint: Stored XSS via saved connection parameters

Vendor

GitHub Security Advisories

Published

November 10, 2026

Last Modified

November 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-123364 →

📋 Description

Impact

OctoPrint versions 2.0.0rc1 up until version 2.0.0rc6 are susceptible to cross-site scripting via a specially crafted default port or baudrate setting on the bundled Serial Connector plugin, supplied via the API as new defaults during a connect request.

Patches

The vulnerability is patched in 2.0.0rc7.

Workaround

Check config.yaml for Javascript fragments in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate. If found, remove them. You can check who of your users had access to your instance since you flashed 2.0.0rc1 or above via auth.log.

Credits

This vulnerability was discovered and responsibly disclosed to OctoPrint by "mahn-don".

Timeline

2026-10-14: Report received 2026-10-14: Report acknowledged 2026-10-14: Report verified 2026-10-14: Fix ready for 2.0.0rc7 2026-10-20: CVE requested

🎯 Affected products1

pip/OctoPrint:>= 2.0.0rc1, <= 2.0.0rc6