PrusaSlicer Pre-2.4 G-code Write Mechanism Change and Post-Processing Script Compatibility

Vulnerability Overview PrusaSlicer versions prior to 2.4 contain a design flaw that causes it to write G-code directly to the user-specified target media (e.g., SD cards) instead of first writing it to the system's temporary directory. Scope of Impact Affected Versions: All versions of PrusaSlicer prior to 2.4. Impact Scenarios: Occurs when users configure output options to send G-code to local hard drives, removable media (such as SD cards), or specific hosts (such as PrusaLink, OctoPrint, etc.). Remediation Version 2.4 and Later: The process has been changed to first write G-code to a temporary folder on the system drive, then execute post-processing scripts, and finally send the result to the target location. Advantages: This avoids direct writes to wear-prone storage media (such as SD cards) and enhances functionality (e.g., supporting post-processing scripts). Note: This change may break existing post-processing scripts that rely on the old behavior (direct writing to the final file). POC / Exploitation Code There is no directly exploitable vulnerability code, but the change in the post-processing script execution mechanism is involved: > Note: The code above is a post-processing script example provided in the documentation, not exploitation code. It is used solely to illustrate the differences in script execution environments between old and new versions.

Goal Reached Thanks to every supporter — we hit 100%!

PrusaSlicer Pre-2.4 G-code Write Mechanism Change and Post-Processing Script Compatibility