CVE-2026-107397— Indico: Cross-Site-Scripting in minutes editor
Quick assessment
Affected
indico indico
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Indico 是一个活动管理系统，它使用了 Flask-Multipass，这是一个用于 Flask 的多后端身份验证系统。在 3.3.13 版本之前，具有内容创建权限的用户（包括能够创建会议纪要的演讲者）可以在活动会议纪要中存储精心构造的 HTML 代码。当对同一份会议纪要进行并发编辑时，会议纪要编辑器冲突界面可能会在 Indico 源站中执行攻击者控制的脚本，从而影响查看者的浏览器。此问题已在 3.3.13 版本中修复。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107397
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Indico: Cross-Site-Scripting in minutes editor
Source: CVE Program / CVE List V5
Vulnerability Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, the minute editor conflict UI can execute attacker-controlled script in the viewer's browser in the Indico origin. This issue is fixed in version 3.3.13.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-107397
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107397
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-107397 (2)
Vendor Advisories for CVE-2026-107397 (1)
-
🔗 Cross-Site-Scripting in minutes editor · Advisory · indico/indico · GitHub x_refsource_CONFIRM
Vendor Pages for CVE-2026-107397 (1)
-
🔗 Release v3.3.13 · indico/indico · GitHub x_refsource_MISC
Same Patch Batch · indico · 2026-10-08 · 4 CVEs total
| CVE-2026-107394 | 6.8 MEDIUM | Indico: Incomplete Server-Side Request Forgery (SSRF) check |
| CVE-2026-107396 | 5.4 MEDIUM | Indico: Cross-Site-Scripting in link fields |
| CVE-2026-107395 | 4.3 MEDIUM | Indico: Missing access check in legacy session export API |
IV. Related Vulnerabilities
Same product: indico
-
CVE-2026-107396
Indico: Cross-Site-Scripting in link fields -
CVE-2026-107395
Indico: Missing access check in legacy session export API -
CVE-2026-107394
Indico: Incomplete Server-Side Request Forgery (SSRF) check -
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execut -
CVE-2026-28352
Indico missing access check in event series management API
Same vendor: indico
-
CVE-2026-107396
Indico: Cross-Site-Scripting in link fields -
CVE-2026-107395
Indico: Missing access check in legacy session export API -
CVE-2026-107394
Indico: Incomplete Server-Side Request Forgery (SSRF) check -
CVE-2026-33046
Indico discloses local files resulting in Remote Code Execut -
CVE-2026-28352
Indico missing access check in event series management API
Same weakness: CWE-79
-
CVE-2026-107889
Keycloak-services: keycloak-services: stored xss on login pa -
CVE-2026-107801
Jivejdon through 5.0 Stored XSS via Attachment Upload Conten -
CVE-2026-107800
Jivejdon through 5.0 Stored XSS via Private Short Messages -
CVE-2026-107799
Jivejdon through 5.0 Stored XSS via messageListBody.jsp Foru -
CVE-2026-107797
Jivejdon through 5.0 Reflected XSS via postThread.jsp to and
V. Comments for CVE-2026-107397
No comments yet