{"schema":"threatline.record/2","record":{"id":"CVE-2026-107397","aliases":["GHSA-cw24-x4mj-fw3q","PYSEC-2026-4228"],"summary":"Indico: Cross-Site-Scripting in minutes editor","details":"### Impact\nThere is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event.\n\n### Patches\nYou should to update to [Indico 3.3.13](https://github.com/indico/indico/releases/tag/v3.3.13) as soon as possible.\nSee [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update.\n\n### Workarounds\n- Set `CSP_ENABLED = True` in `indico.conf` - **this is recommended regardless of updating**.\n- Only let trustworthy users create content (including minutes which speakers can typically do as well) on Indico.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open a thread in [our forum](https://talk.getindico.io/)\n- Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)","categories":["Libraries & packages"],"product":"indico","vendor":"indico","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cw24-x4mj-fw3q","source_modified_at":"2026-10-08T22:09:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"indico"},"range":"< 3.3.13"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107397","source_modified_at":"2026-10-13T16:15:08.869Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"indico","vendor":"indico","versions":[{"version":"< 3.3.13","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cw24-x4mj-fw3q","source_modified_at":"2026-10-15T14:56:21.251667589Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"indico","ecosystem":"PyPI","purl":"pkg:pypi/indico"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.13"}]}],"versions":["0.98-rc1","0.98.0","0.98.1","0.98.2","0.99","1.0","1.1","1.1.1","1.1.2","1.2","1.2.1","1.2.1rc10","1.2.1rc11","1.2.1rc2","1.2.1rc4","1.2.1rc5","1.2.1rc6","1.2.1rc7","1.2.1rc9","1.2.2","1.2.2rc1","1.9.11.dev10","1.9.11.dev11","1.9.11.dev12","1.9.11.dev13","1.9.11.dev14","1.9.11.dev15","1.9.11.dev16","1.9.11.dev17","1.9.11.dev3","1.9.11.dev4","1.9.11.dev6","1.9.11.dev7","1.9.11.dev8","1.9.11.dev9","2.0","2.0.1","2.0.2","2.0.3","2.0a1","2.0rc1","2.0rc2","2.1","2.1.1","2.1.10","2.1.11","2.1.2","2.1.3","2.1.4","2.1.5"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cw24-x4mj-fw3q","source_modified_at":"2026-10-08T22:09:46Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"indico"},"version":"3.3.13"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cw24-x4mj-fw3q","source_modified_at":"2026-10-15T14:56:21.251667589Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"indico","ecosystem":"PyPI","purl":"pkg:pypi/indico"},"version":"3.3.13"}],"cvss":4.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00233,"percentile":0.13383,"score_date":"2026-10-23"},"published_at":"2026-10-08T20:01:56.769Z","modified_at":"2026-10-15T14:56:21.251667589Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-cw24-x4mj-fw3q","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T22:09:46Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107397","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-13T16:15:08.869Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-cw24-x4mj-fw3q","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-15T14:56:21.251667589Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107397","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/indico/indico/security/advisories/GHSA-cw24-x4mj-fw3q","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107397","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/indico/indico/pull/7619","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/indico/indico/releases/tag/v3.3.13","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-cw24-x4mj-fw3q","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-13T16:14:58.513429Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:56:21.251667589Z","content_hash":"a392da6ceec0d43f97747d4e4a2e1ad0a4279afe1c78af587a31ce6548dd1e1f"}}