CVE-2022-3607

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in octoprint/octoprint

6.0MediumCVSS base score
0.43%Exploitation in 30 daysEPSS · top 62% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
YesPublic exploitsa reference or SSVC says so

Description

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository octoprint/octoprint prior to 1.8.3.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

Timeline

2022
19 Oct 2022
19 Oct 2022
Published
2025
9 May 20253 years later
9 May 2025· 3 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-3607, by who scored it
Scored by	CVSS	Score	Vector
@huntrdevCNA (assigner)	3.0	Medium6.0	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
NVDNVD · Modified	3.1	Medium6.0	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.43% · top 62% of all CVEs (11 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.0.

Affected products

octoprint · octoprint/octoprint
- affected unspecified – < 1.8.3

Affected packages

From reviewed advisories of the GitHub Advisory Database.

PyPIOctoPrintGHSA-rj5f-vm79-5j84 (opens in a new tab)

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-3607](https://cveledger.app/badge/CVE-2022-3607.svg)](https://cveledger.app/cve/CVE-2022-3607)

Record last updated 9 May 2025, 14:47 UTC.