Threats tagged 'ghsa-p623-mxf7-qxjm'

OctoPrint versions from 2.0.0rc1 up to but not including 2.0.0rc7 contain a stored cross-site scripting (XSS) vulnerability in the Serial Connector plugin. This occurs via specially crafted default 'port' or 'baudrate' settings supplied through the API during a connect request. The vulnerability is patched in version 2.0.0rc7. Users should check their configuration files for malicious JavaScript fragments and remove them as a workaround.