CVE-2025-64187

OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. This issue is fixed in version 1.11.4.

• CWE-80

• https://github.com/OctoPrint/OctoPrint/commit/9112e07b1085f4c1ee9eefc67985809251057a44Patch
• https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-crvm-xjhm-9h29Vendor Advisory

Published

Nov 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64181OpenEXR provides the specification and reference implementat…7.5
• CVE-2025-64182OpenEXR provides the specification and reference implementat…7.8
• CVE-2025-64183OpenEXR provides the specification and reference implementat…7.5
• CVE-2025-64184Dosage is a comic strip downloader and archiver. When downlo…8.8
• CVE-2025-64185Open OnDemand is an open-source HPC portal. Prior to version…6.9
• CVE-2025-64186Evervault is a payment security solution. A vulnerability wa…6.5
• CVE-2025-64188Incorrect Privilege Assignment vulnerability in PenciDesign …9.8
• CVE-2025-64189Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-6419A vulnerability was found in code-projects Simple Online Hot…9.8
• CVE-2025-64190Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-64191Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-64192Missing Authorization vulnerability in 8theme XStore xstore …6.3