Readiness report
Klipper 3D Printer Control Stack (Moonraker + Mainsail) · 2026-09-03 03:49 · complete · 7 searches, 9 pages fetched
Cybersecurity — software & network: Review before networking · 11 findings
Details in the Cybersecurity section of the report below.
Readiness: Klipper 3D Printer Control Stack (Moonraker + Mainsail)
Verdict: Ready · 2026-09-03 · est. parts cost $70–$194 (required items; optional webcam and smart plug add about $27–$122) Cybersecurity — software & network: Review before networking
Every hardware line in this lab is a current, commodity item stocked by several sellers at ordinary retail prices — no obsolescence, no single-sourcing, and no stock problem anywhere in the bill of materials. The bill of materials is also unusually forgiving: it names categories (a Linux single-board computer, a Klipper-supported mainboard, a UVC webcam) rather than specific manufacturer part numbers, so substitution latitude is wide on every line. This is the cold check — there is no previous report for this lab, so the prices and availability below establish the baseline that the next check will measure drift against. The attention this lab needs is on its software and network posture, not on sourcing its parts.
Action required
None — all checked parts are sourceable.
Cybersecurity — software & network
Review before networking — Every tier resolved to pinned dependencies and was checked, but eight advisories (three high severity) and three network-posture defaults stand between this stack and a shared network.
| Component | Version | How known | Support status |
|---|---|---|---|
| Klipper (firmware + Klippy host daemon) | not determined | unpinned (installed from a git checkout of github.com/Klipper3d/klipper; the lab materials pin no tag or commit) | — |
| Moonraker (API server) | not determined | unpinned (version is generated from git SCM by the PDM backend at build time (pyproject.toml source = scm); no static version exists to check) | — |
| Mainsail (web frontend) | 2.19.0 | read from project (package.json name/version literal, confirmed by extraction; the repo also ships package-lock.json (901 pinned rows fetched this run), so Mainsail's caret ranges do resolve to pinned versions - the snapshot's 'no lockfile is provided' note is out of date) | — |
| Node.js (Mainsail build/runtime) | 20.19.0 | inferred (lower bound of the engines constraint '^20.19.0 || >=22.12.0' in package.json) | unsupported since 2026-04-30 |
| Python (Moonraker runtime) | 3.10 | inferred (lower bound of requires-python '>=3.10' in Moonraker's pyproject.toml) | supported until 2026-10-31 |
| Jinja2 (Klippy G-code macros) | 2.11.3 | read from project (klippy-requirements.txt) | — |
| setuptools (Klippy) | 78.1.1 | read from project (klippy-requirements.txt (applied on Python 3.12 and newer)) | — |
| pyserial (Klippy MCU link) | 3.4 | read from project (klippy-requirements.txt) | — |
| python-can (Klippy CAN bus link) | 3.3.4 | read from project (klippy-requirements.txt) | — |
| tornado (Moonraker HTTP/WebSocket server) | 6.5.8 | read from project (uv.lock) | — |
| Jinja2 (Moonraker) | 3.1.6 | read from project (uv.lock) | — |
| zeroconf (Moonraker mDNS discovery) | 0.150.0 | read from project (uv.lock) | — |
| paho-mqtt (Moonraker MQTT) | 2.1.0 | read from project (uv.lock) | — |
| ldap3 (Moonraker LDAP authentication) | 2.9.1 | read from project (uv.lock) | — |
| pillow (Moonraker image handling) | 12.3.0 | read from project (uv.lock) | — |
| streaming-form-data (Moonraker file uploads) | 2.1.0 | read from project (uv.lock) | — |
| vuetify (Mainsail UI framework) | 2.7.2 | read from project (package-lock.json) | — |
| vue (Mainsail UI framework) | 2.7.16 | read from project (package-lock.json) | — |
| echarts (Mainsail charts) | 5.6.0 | read from project (package-lock.json) | — |
| nanoid (Mainsail, transitive) | 3.3.16 | read from project (package-lock.json) | — |
| dompurify (Mainsail HTML sanitiser) | 3.4.13 | read from project (package-lock.json) | — |
| hls.js (Mainsail video streaming) | 1.6.16 | read from project (package-lock.json) | — |
| axios (Mainsail HTTP client) | 1.18.1 | read from project (package-lock.json) | — |
| browserslist (Mainsail build toolchain, dev-only) | 4.28.4 | read from project (package-lock.json) | — |
| vue-template-compiler (Mainsail build toolchain, dev-only) | 2.7.16 | read from project (package-lock.json) | — |
| Component | Finding | Severity | Fix available? |
|---|---|---|---|
| browserslist (Mainsail build toolchain, dev-only) | The build toolchain used to compile Mainsail can crash or grow memory without bound on untrusted input; this affects whoever rebuilds Mainsail from source, not the printer at run time. — GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx | high | Yes - update to 4.28.7 |
| nanoid (Mainsail, transitive) | A helper library bundled into the Mainsail interface can loop indefinitely when asked for a zero-length ID, which can hang the page. — GHSA-2v37-7h3g-55p8 | high | Yes - update to 3.3.18 |
| vuetify (Mainsail UI framework) | The version of Vuetify the Mainsail interface is built from has a prototype-pollution flaw and a cross-site scripting flaw in its date-picker, both reachable from the printer's web interface in a student's browser. — GHSA-3jp5-5f8r-q2wg, GHSA-9w3x-85mw-4fwm | high | No - project pins vue ^2.7.10 (package.json); the fixes only exist in Vuetify 3, which requires a move to Vue 3 upstream. |
| echarts (Mainsail charts) | The charting library drawing Mainsail's temperature graphs has a cross-site scripting flaw. — GHSA-fgmj-fm8m-jvvx | moderate | No - project pins echarts ^5.5.0 (package.json); the fix lands in 6.1.0, outside that range. |
| Jinja2 (Klippy G-code macros) | Klipper pins a 2021-era Jinja2 for its G-code macro engine; it carries four advisories including two template sandbox escapes, which matter if students or downloaded configs supply macro text the instructor has not reviewed. — GHSA-q2x7-8rv6-6q7h, GHSA-h75v-3vvj-5mfj, GHSA-h5c8-rqwp-cp95, GHSA-cpwx-vrp4-4pq7 | moderate | No - project pins Jinja2==2.11.3 (klippy-requirements.txt); treat printer.cfg macros as trusted code and review anything pasted in from the internet. |
| setuptools (Klippy) | A packaging-time file-exclusion bypass on macOS filesystems; it affects building source distributions, not a Klipper install running on the Raspberry Pi. — GHSA-h35f-9h28-mq5c | moderate | No - project pins setuptools==78.1.1 (klippy-requirements.txt); no action needed for this lab's deployment. |
| vue-template-compiler (Mainsail build toolchain, dev-only) | The Vue 2 template compiler has an unfixed cross-site scripting issue; it runs at build time only and is not shipped to the browser. — GHSA-g3ch-rx76-35fx | moderate | Mitigation only - no fixed version exists; build Mainsail only from the official repository. |
| vue (Mainsail UI framework) | Vue 2's HTML parser can be slowed to a crawl by a crafted template, a denial-of-service rather than a data exposure. — GHSA-5j4c-8p2g-v4jx | low | No - project pins vue ^2.7.10 (package.json); the fix is in Vue 3. |
| Moonraker (API server) | Moonraker's documented default binds the HTTP API to every IPv4 interface (host: 0.0.0.0) on port 7125 in clear text; the HTTPS listener on 7130 starts only if a certificate and key are configured, so printer control and G-code uploads cross the network unencrypted by default. | posture | Mitigation only - keep the printer on an isolated lab network or VLAN, and configure the SSL certificate and key options if the interface must cross networks. |
| Moonraker (API server) | Moonraker does not require a user login by default (force_logins: False) and ships with no trusted_clients entries, so access control rests entirely on whatever the operator configures after install. | posture | Mitigation only - create a Moonraker user and set force_logins: True, and list only the instructor workstations or the lab subnet in trusted_clients. |
| Node.js (Mainsail build/runtime) | The lower bound of Mainsail's engines constraint lands on Node.js 20, whose support ended 2026-04-30, so a build following the stated minimum runs on an end-of-life runtime. | posture | Yes - update to Node.js 22.12.0 or later, which the project's own engines constraint '^20.19.0 || >=22.12.0' already allows. |
What this means for your lab
Moonraker is the service that actually drives the printer, and by default it listens on every network interface of the host computer on port 7125 in plain, unencrypted HTTP, with no login required until you turn one on. Anyone who can reach that address - any other machine on the same network - can therefore drive the printer: start and stop jobs, move the axes, set heater temperatures, and upload or download G-code files. Before this goes anywhere near a shared campus network, put the printer on an isolated lab network or VLAN, create a Moonraker user and set force_logins to True, list only the instructor workstations in trusted_clients, and raise it with campus IT before giving the device a routable address. Build the web interface with Node.js 22 rather than Node 20, which stopped receiving support in April 2026. The vulnerabilities found are mostly in the browser-side interface and the build tooling rather than in the printer control path; the two Vuetify ones cannot be fixed locally, because the fix only exists in a newer major version that Mainsail has not moved to yet.
Not checked
- MainsailOS: no version stated in the lab materials; the prebuilt image bundles its own OS and application versions, none of which were pinned for this check
- FluiddPi: no version stated in the lab materials
- prind (Docker deployment suite): no version or image tag stated in the lab materials
- Klipper firmware/Klippy itself: installed from an unpinned git checkout, so there is no release version to check against an advisory database; its pinned Python dependencies were checked
- Moonraker itself: version is generated from git SCM at build time, so there is no static version to check; its locked Python dependencies were checked via uv.lock
- pdm-backend: declared as a build-system requirement, so it is not part of the parsed runtime dependency set or uv.lock and no version was resolved this run
- Host OS (Raspberry Pi OS / Debian): no OS version or release codename stated in the lab materials, so no support-status lookup was possible
- moonraker-timelapse plugin: external plugin repository named in the snapshot with no version stated; no manifest was fetched for it this run
- 398 further dependencies in package-lock.json: beyond the 500-dependency automatic check cap (e.g. commander, common-tags, concat-map, convert-source-map, core-js-compat)
Parts
Bill of Materials and Hardware Requirements
| Part | Spec/Package | Status | Stock | Price | Source |
|---|---|---|---|---|---|
| Host Single-Board Computer | Raspberry Pi 4 Model B, 2 GB or 4 GB; 5.0–5.1 V DC, 2.5–3.0 A | Readily available | In stock, many sellers | $35.00 (capacity not stated in listing); $61.05 confirmed 4 GB | Seeed Studio; Vilros |
| 3D Printer Microcontroller Mainboard | BIGTREETECH SKR series or any Klipper-supported MCU board; 12 V or 24 V DC bus | Readily available | In stock, many sellers | $32.05 (SKR V1.4); $39.99 (SKR Mini E3 V3.0) | BIQU 3D; Micro Center |
| Host-to-MCU Serial/USB Interface Cable | USB 2.0 A to B data cable, data lines wired | Readily available | In stock, many sellers | $3.29 (right-angle A end); $10.67 (straight) | USBGear; Walmart |
| USB / CSI Webcam or Video Streamer (optional) | UVC USB webcam or Pi Camera Module; 5 V USB or 3.3 V CSI | Readily available | In stock, many sellers | $13.29; $19.99 | Walmart; Best Buy |
| External Power Control Relay / Smart Plug (optional) | Tasmota / TP-Link HTTP API switch or GPIO relay; 110–240 V AC, 10–15 A | Readily available | In stock, many sellers | $14.00 (SONOFF S31); $19.99 (Tasmota pre-flashed) | CloudFree; eBay |
Notes on the rows above, from the judge:
- Raspberry Pi: the $35.00 listing does not state its memory capacity, so it is not confirmed as the 2 GB or 4 GB variant the lab calls for; $61.05 is the cheapest listing that explicitly says 4 GB. Listings from $130.00 to $165.00 are desktop/starter kits that bundle a power supply, case and SD card.
- Mainboard: a $3.79 listing for an "SKR Mini E3 V3.0" also appeared. It is an order of magnitude below every other listing of the same board and should be treated as an accessory or a bad feed price, not as the board — the realistic floor is about $32. The boards priced above cover the STM32, LPC176x and RP2040 families the snapshot lists as Klipper-supported.
- USB cable: the highest-ranked search results included a USB 3.0 A-to-A cable and a Micro-B to USB-C hard-drive cable. Both are the wrong connector type and are excluded; the prices given are for genuine A-to-B data cables. The low-priced USBGear items have a right-angle A connector.
- Webcam: UVC compliance is not stated in any listing and no product page was fetched, so it is unverified. Confirm UVC support before ordering in quantity.
- Smart plug: the SONOFF S31 listing does not state that it ships pre-flashed with Tasmota; the $19.99 eBay listing does. A Shelly Plug Gen4 ($24.99, Best Buy) also appeared but uses a control protocol the snapshot does not name.
Substitutes
None needed.
Other dependencies
- github.com/Klipper3d/klipper — reachable this run (the
scripts/directory listed, 49 entries). - github.com/Arksine/moonraker — reachable this run (repository root listed, 18 entries).
- github.com/mainsail-crew/mainsail — reachable this run (repository root listed, 31 entries).
- klipper3d.org, moonraker.readthedocs.io, docs.mainsail.xyz — not checked (no page fetched this run).
- github.com/mainsail-crew/moonraker-timelapse (external plugin) — not checked.
- Board fabrication — not applicable. The snapshot records no PCB layout files, Gerber data, or board geometry; this is a software and configuration repository.
Watch list
- Raspberry Pi 4 Model B — the oldest hardware line here and the one most exposed to supply swings and to being superseded; Pi 4 pricing has historically moved more than the rest of this BOM. Watch whether the sub-$40 listings still exist next check, and whether they state a memory capacity.
- BIGTREETECH mainboards — model churn rather than scarcity is the risk. Specific SKR revisions get replaced regularly, so expect the exact board named here to rotate even while the category stays cheap and plentiful.
- Optional webcam — the UVC claim is still unverified. If the lab depends on the camera, confirm UVC support on a specific model and pin that model, rather than re-checking the category.
- Tasmota smart plugs — availability of pre-flashed units is thinner than the category overall, and vendors change what they ship pre-flashed without notice.