{"cve":"CVE-2024-49377","nvd":{"published":"2024-11-05T19:15:05.737","modified":"2026-06-17T07:59:47.483","status":"Analyzed","description":"OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog.  An attacker who successfully talked a victim into clicking on a specially crafted login link, or a malicious app running on a victim's computer triggering the application key workflow with specially crafted parameters and then redirecting the victim to the related standalone confirmation dialog could use this to retrieve or modify sensitive configuration settings, interrupt prints or otherwise interact with the OctoPrint instance in a malicious way. The above mentioned specific vulnerabilities of the login dialog and the standalone application key confirmation dialog have been patched in the bugfix release 1.10.3 by individual escaping of the detected locations. A global change throughout all of OctoPrint's templating system with the upcoming 1.11.0 release will handle this further, switching to globally enforced automatic escaping and thus reducing the attack surface in general. The latter will also improve the security of third party plugins. During a transition period, third party plugins will be able to opt into the automatic escaping. With OctoPrint 1.13.0, automatic escaping will be switched over to be enforced even for third party plugins, unless they explicitly opt-out.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79","CWE-80"],"references":["https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-xvxq-g8hw-fx4g"],"products":["octoprint:octoprint"],"source":"nvd","synced_at":"2026-10-19T21:57:07.693694550+00:00"},"epss":{"cve":"CVE-2024-49377","score":0.00289,"percentile":0.2149,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-xvxq-g8hw-fx4g","url":"https://osv.dev/vulnerability/GHSA-xvxq-g8hw-fx4g","summary":"OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates","modified":"2025-01-21T18:20:43.061515Z","packages":[{"ecosystem":"PyPI","name":"octoprint","purl":"pkg:pypi/octoprint","ranges":["<1.10.3"],"fixed":["1.10.3"]}]},{"id":"PYSEC-2024-201","url":"https://osv.dev/vulnerability/PYSEC-2024-201","summary":"","modified":"2025-01-19T16:57:01.497087Z","packages":[{"ecosystem":"PyPI","name":"octoprint","purl":"pkg:pypi/octoprint","ranges":["<1.10.3"],"fixed":["1.10.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}