Medium severity · published Oct 8, 2026
CVE-2026-107396
Indico: Cross-Site-Scripting in link fields
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can manage events or create content, including speakers who can upload material, can store crafted javascript URLs in fields that accept custom URLs. A user who follows one of these URLs can execute attacker-controlled script in the user's browser in the Indico origin. This issue is fixed in version 3.3.13.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
indico · indico
< 3.3.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107396
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107396
x_refsource_CONFIRM
https://github.com/indico/indico/security/advisories/GHSA-c4wc-ggrj-jg9v
x_refsource_MISC
https://github.com/indico/indico/pull/7619
x_refsource_MISC
https://github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18
x_refsource_MISC
https://github.com/indico/indico/releases/tag/v3.3.13
More from indico
8.8
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execution through LaTeX injection
6.8
CVE-2026-107394
Indico: Incomplete Server-Side Request Forgery (SSRF) check
6.5
CVE-2026-28352
Indico missing access check in event series management API
6.5
CVE-2025-53640
Indico vulnerable to user enumeration via API endpoint
6.1
CVE-2024-45399
Indico has a Cross-Site-Scripting during account creation