OctoPrint versions up to and including 1.11.3 are vulnerable to a cross-site scripting (XSS) flaw in the Action Command notification and prompt popups. This allows an attacker to inject arbitrary HTML and JavaScript if a victim prints a specially crafted file. Exploitation can disrupt prints, extract sensitive information, or perform actions on behalf of the user. The issue is fixed in version 1.11.4. Administrators can mitigate risk by disabling popups for Action Command notifications and prompts and ensuring print files come from trusted sources.