OctoPrint’s web interface allows an authenticated user to submit connection parameters such as the default port or baudrate to its bundled Serial Connector plugin. These values are persisted without sanitization and later rendered as HTML in another user’s browser when the saved settings are viewed, leading to a stored cross‑site scripting flaw. The injected script runs in the context of any user who views the parameters, enabling the attacker to execute client‑side code, which could hijack the user’s session or perform unauthorized actions within that user’s OctoPrint access.

The vulnerability affects the OctoPrint web interface on versions 2.0.0rc1 through 2.0.0rc6 that include the bundled Serial Connector plugin. It is mitigated by upgrading to 2.0.0rc7 or later, where the issue has been fixed.

The CVSS score of 2.4 indicates a low overall severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentic access to an OctoPrint instance and the ability to submit a connect request, making it primarily an internal threat. Although the flaw is client‑side and does not grant server‑side code execution, a malicious script can perform actions with the privileges of the victim user, such as initiating prints or altering settings.