CVE-2026-107396: Indico Cross-Site Scripting Vulnerability in Custom URL Fields
Summary
CVE-2026-107396: Indico: Cross-Site-Scripting in link fields. Affects indico versions < 3.3.13. Fixed in 3.3.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Indico is an open-source event management software that allows users to create, manage, and host events online. It provides features such as registration, scheduling, and content management. However, it has been found to contain a Cross-Site Scripting (XSS) vulnerability in fields that allow users to enter custom URLs, which could potentially be exploited by malicious actors.
Vulnerability Detail
The vulnerability arises from improper validation of user input in custom URL fields, allowing attackers to inject malicious scripts. This can lead to unauthorized actions being performed on behalf of users, data theft, or other malicious activities. The technical aspect of this vulnerability is categorized under CWE-692, indicating a lack of proper input validation.
How To Fix
Latest published version: 3.3.14 as of 22 Oct 2026
pip install --upgrade "indico==3.3.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.13
This is the first release that contains the fix.
pip install --upgrade "indico==3.3.13"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can enable Content Security Policy (CSP) by setting 'CSP_ENABLED = True' in the 'indico.conf' file. This is recommended regardless of whether the package is updated. Additionally, it is advisable to restrict event management and content creation to trustworthy users only.
Conclusion
In summary, the Cross-Site Scripting vulnerability in Indico poses a moderate risk to users by allowing the injection of malicious scripts through custom URL fields. It is crucial to update to version 3.3.13 or later to mitigate this risk. Additionally, implementing the recommended workarounds can provide further protection.
See every vulnerability recorded for indico →
FAQ
Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
You can check if your installation is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without needing to sign up.
The consequences include unauthorized access to user accounts, data theft, and the ability to perform actions on behalf of users, which can compromise the integrity of the application.
Yes, it is highly recommended to apply the patch as soon as possible to mitigate the risk of exploitation.
Vulert is a monitoring tool that alerts users in real-time about open-source vulnerabilities in their software. It uses Pipfile.lock to track vulnerabilities without requiring access to the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for indico.
