DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-107397: CVE-2026-107397: Stored Cross-Site Scripting via Collaborative Editor Conflict Resolution and Custom Link Fields in Indico

#security #cve #cybersecurity

CVE-2026-107397: Stored Cross-Site Scripting via Collaborative Editor Conflict Resolution and Custom Link Fields in Indico

Vulnerability ID: CVE-2026-107397
CVSS Score: 4.4
Published: 2026-10-08

A technical analysis of CVE-2026-107397, a stored Cross-Site Scripting (XSS) vulnerability in Indico's collaborative notes editor and custom link generation fields. Prior to version 3.3.13, Marshmallow serialization schemas omitted HTML sanitization during conflict resolution, and form validators failed to enforce strict URI schemes, enabling authenticated low-privilege attackers to execute arbitrary JavaScript.

TL;DR

Vulnerabilities in Indico's conflict resolution interface and custom link fields allowed authenticated users to inject arbitrary HTML/JavaScript (Stored XSS). Fixed in version 3.3.13.

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS v3.1 Score: 4.4 (Medium)
  • Exploit Status: None (No Public PoC)
  • Impact: Stored Cross-Site Scripting (XSS)
  • CISA KEV Status: Not Listed

Affected Systems

  • Indico collaborative minutes editor and custom link fields
  • Indico: < 3.3.13 (Fixed in: 3.3.13)

Code Analysis

Commit: d4c8c71

Fix XSS in minutes conflict resolution and custom link fields

Mitigation Strategies

  • Upgrade Indico to version 3.3.13 or newer.
  • Enforce strict Content Security Policy (CSP) headers in the Indico configuration to block inline scripts.
  • Deploy Web Application Firewall (WAF) rules to detect and block common XSS payload patterns on note editing endpoints.

Remediation Steps:

  1. Activate the application's virtual environment.
  2. Run 'pip install --upgrade indico' to pull the patched version (3.3.13+).
  3. Restart the uwsgi and celery services to apply the code changes.
  4. Verify CSP settings in the indico.conf file to ensure 'CSP_ENABLED = True'.

References

Read the full report for CVE-2026-107397 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)