CVE-2026-107396GHSA-c4wc-ggrj-jg9vPYSEC-2026-4227

Indico: Cross-Site-Scripting in link fields

indico indicopipLibraries & packages

CVSS

5.4Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in3.3.13Fixed versionGitHub

Published8 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Impact

There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs.

Patches

You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update.

Workarounds

Set CSP_ENABLED = True in indico.conf - this is recommended regardless of updating.
Only let trustworthy users manage events or create content (including material uploads which speakers can typically do as well) on Indico.

For more information

If you have any questions or comments about this advisory: