CVE-2026-107397

Deferred Deferred - Pending Action

Stored XSS in Indico Event Minutes via Concurrent Edits

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, the minute editor conflict UI can execute attacker-controlled script in the viewer's browser in the Indico origin. This issue is fixed in version 3.3.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107397

Affected Vendors & Products

Vendor	Product	Version / Range
indico	indico	< 3.3.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in Indico allows users who can create content, such as speakers adding minutes, to store malicious HTML in event minutes. When multiple users edit the same minutes simultaneously, the conflict resolution UI can execute attacker-controlled scripts in the browser of other viewers within the Indico domain.

Detection Guidance

This vulnerability can be detected by checking the Indico version installed on your system. If the version is prior to 3.3.13, the system is vulnerable. No specific commands are provided in the context to detect the vulnerability directly.

Impact Analysis

An attacker could exploit this to run malicious scripts in your browser when viewing event minutes, potentially stealing session cookies, sensitive data, or performing actions on your behalf within Indico.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality.

Mitigation Strategies

Upgrade Indico to version 3.3.13 or later to address the vulnerability in the minute editor conflict UI that allows script execution.

Hi! I’m here to help you understand CVE-2026-107397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70