CVE-2025-64187
NoneCVSS
—
EPSS
0.2%
Published
Nov 7, 2025
CISA due date
—
The record
OctoPrint is vulnerable to XSS through Action Command Notifications and Prompts
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | octoprint | 0 | 1.11.4 |
Related vulnerabilities
- GHSA-crvm-xjhm-9h29 OctoPrint vulnerable to XSS in Action Commands Notification and Prompt Same vulnerability
- CVE-2026-23892 OctoPrint provides a web interface for controlling consumer 3D printers. Also affects octoprint
- GHSA-xg4x-w2j3-57h6 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication Also affects octoprint
- CVE-2025-58180 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload Also affects octoprint
- CVE-2026-52773 YesWiki is a wiki system written in PHP. CWE-80
- CVE-2026-52774 YesWiki is a wiki system written in PHP. CWE-80
- CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a… CWE-80
- CVE-2026-82838 The default docker image shipped for Venueless did not properly ensure that uploaded SVG… CWE-80