ZeroDay Findings
Sign inSign up

Findings

CVE-2026-107397

Indico: Cross-Site-Scripting in minutes editor

Published Oct 8, 2026 · updated Oct 15, 2026

### Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. ### Patches You should to update to [Indico 3.3.13](https://github.com/indico/indico/releases/tag/v3.3.13) as soon as possible. See [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to update. ### Workarounds - Set in - **this is recommended regardless of updating**. - Only let trustworthy users create content (including minutes which speakers can typically do as well) on Indico. ### For more information If you have any questions or comments about this advisory: - Open a thread in [our forum](https://talk.getindico.io/) - Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 8, 2026 · GitHub Advisory Database

    Detected

    ### Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. ### Patches You should to update to [Indico 3.3.13](https://github.com/indico/indico/releases/tag/v3.3.13) as soon as possible. See [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to updat

  2. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    indico fixed in 3.3.13

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    indico fixed in 3.3.13

  4. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event. ### Patches You should to update to [Indico 3.3.13](https://github.com/indico/indico/releases/tag/v3.3.13) as soon as possible. See [the docs](https://docs.getindico.io/en/stable/installation/upgrade/) for instructions on how to updat

Affected

  • PyPI indico0 → 3.3.13

Sources

References

CVE-2026-107397 · ZeroDay Findings