{"vulnerability": "CVE-2026-107396", "sightings": [{"uuid": "658b9401-1115-4744-92e7-ae24cd54e05a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107396", "type": "seen", "source": "https://gist.github.com/alon710/5f328cf810b2a76cf7ffa98428de883c", "content": "# CVE-2026-107396: CVE-2026-107396: Stored Cross-Site Scripting (XSS) in Indico\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107396\n\n## Summary\nA stored Cross-Site Scripting (XSS) vulnerability was identified in Indico, an open-source event management system developed at CERN, prior to version 3.3.13. The vulnerability stems from weak URL validation in custom link fields and lack of HTML sanitization during Marshmallow serialization of event notes. This allows authenticated attackers with event modification privileges to inject malicious payloads that execute in the browser of users viewing the event pages or collaborating on notes.\n\n## TL;DR\nStored XSS in Indico prior to 3.3.13 allows authenticated users to inject malicious URLs and scripts into custom links and event notes, executing in the context of victims' browsers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-692\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4 (Medium)\n- **EPSS Score**: N/A\n- **Exploit Status**: PoC (Proof of Concept)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Indico (event management system)\n- **Indico**: < 3.3.13 (Fixed in: `3.3.13`)\n\n## Mitigation\n\n- Upgrade Indico to version 3.3.13 or newer\n- Implement a strong Content Security Policy (CSP) without 'unsafe-inline' in script-src\n- Deploy Web Application Firewall (WAF) rules to filter 'javascript:' and 'onerror' strings in form payloads\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade indico>=3.3.13' to upgrade the installation.\n2. Verify the update by attempting to submit a 'javascript:' link in attachment forms; the platform should return a validation error.\n3. Audit existing custom links and event notes in the database for presence of 'javascript:' or 'onerror' payloads.\n\n## References\n\n- [GitHub Security Advisory GHSA-c4wc-ggrj-jg9v](https://github.com/indico/indico/security/advisories/GHSA-c4wc-ggrj-jg9v)\n- [Official Fix Commit](https://github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18)\n- [Pull Request #7619 (Sanitize Notes + Validate URLs)](https://github.com/indico/indico/pull/7619)\n- [Indico v3.3.13 Release Notes](https://github.com/indico/indico/releases/tag/v3.3.13)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-107396)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107396) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T06:30:31.000000Z"}]}