CVE-2025-59035: Indico Vulnerable to Cross-Site Scripting via LaTeX Math Code
Summary
CVE-2025-59035: Indico vulnerable to Cross-Site Scripting via LaTeX math code. Affects indico versions < 3.3.8. Fixed in 3.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Indico is an open-source event management software that allows users to organize conferences, workshops, and other academic events. It provides features for managing submissions, registrations, and schedules, making it a popular choice for institutions and organizations. However, a recent vulnerability has been identified that affects its ability to securely render LaTeX math code in contribution or abstract descriptions.
Vulnerability Detail
The vulnerability arises from improper handling of LaTeX math code, which can lead to Cross-Site Scripting (XSS) attacks. This occurs when untrusted input is rendered in a web application without proper sanitization, allowing attackers to inject malicious scripts. If exploited, this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of a user's session, potentially compromising sensitive information or performing actions on behalf of the user.
How To Fix
Latest published version: 3.3.14 as of 22 Oct 2026
pip install --upgrade "indico==3.3.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.8
This is the first release that contains the fix.
pip install --upgrade "indico==3.3.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advised to restrict content creation to trustworthy users only. This can help mitigate the risk of XSS attacks until the software is updated.
Conclusion
The Cross-Site Scripting vulnerability in Indico poses a significant risk to users, particularly those allowing external contributions. It is crucial to update to the patched version as soon as possible and implement temporary workarounds to minimize risk until the update is applied.
See every vulnerability recorded for indico →
FAQ
The vulnerability is a Cross-Site Scripting (XSS) issue that affects how LaTeX math code is rendered in Indico.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the context of a user's session, leading to data theft or unauthorized actions.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 4.6, indicating a moderate level of risk.
Yes, updating to Indico version 3.3.8 or later will permanently fix the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for indico.
