-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| octoprint | pip | <= 1.11.3 | 1.11.4 |
Miggo AIRoot Cause AnalysisThe security vulnerability is a Cross-Site Scripting (XSS) issue found in two OctoPrint plugins: 'action_command_notification' and 'action_command_prompt'. Both plugins are designed to display messages from the printer in the OctoPrint web interface. The root cause of the vulnerability is the failure to properly sanitize user-controllable input that is rendered in a web context. Specifically, messages and prompts originating from the printer (which can be controlled by a malicious G-code file) are displayed to the user without escaping HTML-sensitive characters.
The provided patch addresses this by applying the _.escape() function to the incoming data (data.message, text, and buttons) before it is rendered. This ensures that any HTML or script tags are treated as literal text and not interpreted by the browser, thus mitigating the XSS risk. The vulnerable functions are the anonymous callbacks that handle the printer messages, as they are the ones that process the untrusted data and pass it to the UI rendering components.
(anonymous function)src/octoprint/plugins/action_command_notification/static/js/action_command_notification.js
(anonymous function)src/octoprint/plugins/action_command_prompt/static/js/action_command_prompt.js
PythonPythonOngoing coverage of React2Shell