Pre-Auth RCE in nanoDLP via G-Code Injection (CVE-9.8)

Vulnerability Overview Vulnerability Name: Pre-authentication RCE in nanoDLP stable build #10729 (Nano3Dtech) Vulnerability Type: Remote Code Execution (RCE) CVE Identifier: CVE-9.8 Disclosure Date: August 18, 2026 Disclosed Via: Full Disclosure mailing list Impact Scope Affected Software: nanoDLP stable build #10729 (Nano3Dtech) Vulnerability Description: nanoDLP contains an unauthenticated remote code execution vulnerability. The Guest (unauthenticated) endpoint evaluates user-supplied JavaScript. Within the embedded Otto JS sandbox, this exposes a live NanoDLP domain object via . The object is a pointer shared across requests, and is writable. persists it to without sanitization. An attacker injects into , then another unauthenticated triggers the print engine to execute G-code, causing to run with shell semantics and dynamically validating as . Impact: Complete read access to the host file system with root privileges, arbitrary OS command execution, and full control over both the print server and the host. The injected G-code is persisted and re-executed every time is triggered. Remediation Current Status: No specific remediation steps or patch information are provided on the page. Recommendation: Monitor official updates or contact the vendor for the latest security patches. POC Code No specific POC code is provided on the page, but the following links are available: PoC and Full Analysis: https://github.com/ExploitGarbage/Bday-Rubbish Advisory: https://bday.rubbish.com/blog/nanodlp-unauth-gcode-injection-rce Additional Information Disclosing Team: Bday Rubbish Research Team Contact Email: https://bday.rubbish.com Mailing List: Full Disclosure mailing list Web Archives & RSS: https://seclists.org/fulldisclosure/

Goal Reached Thanks to every supporter — we hit 100%!

Pre-Auth RCE in nanoDLP via G-Code Injection (CVE-9.8)