CVE-2023-41047

    Dashboard / Vulnerabilities / CVE-2023-41047

    CVE-2023-41047

    Published: 9 Oct 2023Last Modified: 27 Aug 2026

    Summary: Improper Neutralization of Special Elements Used in a Template Engine in OctoPrint

    Details: OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An attacker might use this to extract data managed by OctoPrint, or manipulate data managed by OctoPrint, as well as execute arbitrary commands with the rights of the OctoPrint process on the server system. OctoPrint versions from 1.9.3 onward have been patched. Administrators of OctoPrint instances are advised to make sure they can trust all other administrators on their instance and to also not blindly configure arbitrary GCODE scripts found online or provided to them by third parties.

    References: https://github.com/OctoPrint/OctoPrint/releases/tag/1.9.3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41047.json, https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-fwfg-vprh-97ph, https://nvd.nist.gov/vuln/detail/CVE-2023-41047, https://github.com/OctoPrint/OctoPrint/commit/d0072cff894509c77e243d6562245ad3079e17db

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -506648c152681bf4b1416cf2b5aaf97d526ee752

    Affected versions

    1.9.2
    1.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-41047 | CVE-DB