# CVE-2023-37901: Indico vulnerable to Cross-Site-Scripting via confirmation prompts

Source: https://junglewise.ai/threats/cve-2023-37901-indico-vulnerable-to-cross-site-scripting-via-confirmation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-07-21  
License: CC BY 4.0 with a link back

CVE-2023-37901 · Severity: low · CVSS 3.1 · Published 2023-07-21

Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content. Considering that event organizers may want to delete suspicious-looking content when spotting it, there is a non-negligible risk of such an attack to succeed. The risk of this could be further increased when combined with some some social engineering pointing the victim towards this content. Users need to update to Indico 3.2.6 as soon as possible. See the docs for instructions on how to update. Users who cannot upgrade should only let trustworthy users manage categories, create events or upload materials ("submission" privileges on a contribution/event). This should already be the case in a properly-configured setup when it comes to category/event management. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.

Technologies: [indico (PyPI)](https://junglewise.ai/threats/technologies/indico). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2023-37901 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-37901 being exploited in the wild.

**How severe is CVE-2023-37901?** Low severity, with a CVSS score of 3.1, published 21 July 2023.

**Which products and versions are affected?** indico (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.6, GIT:introduced=0,fixed=2ee636d318653fb1ab193803dafbfe3e371d4130|ECOSYSTEM:introduced=0,fixed=3.2.6.

**Is there a fix for CVE-2023-37901?** Yes. indico (PyPI): upgrade to 3.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2023-37901?** Check whether you run indico (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- indico (PyPI): upgrade to 3.2.6 or later

  ```sh
  pip install "indico>=3.2.6"
  ```


## Affected products

- indico (PyPI) ECOSYSTEM:introduced=0,fixed=3.2.6, GIT:introduced=0,fixed=2ee636d318653fb1ab193803dafbfe3e371d4130|ECOSYSTEM:introduced=0,fixed=3.2.6

## Identifiers

- CVE-2023-37901
- GHSA-fmqq-25x9-c6hm
- PYSEC-2023-129

## Related threats

- [Indico Cross-Site-Scripting in minutes editor](https://junglewise.ai/threats/cve-2026-107397-indico-cross-site-scripting-in-minutes-editor)
- [Indico cross-site scripting in link fields](https://junglewise.ai/threats/cve-2026-107396-indico-cross-site-scripting-in-link-fields)
- [Indico missing access check in legacy session export API](https://junglewise.ai/threats/cve-2026-107395-indico-missing-access-check-in-legacy-session-export-api)
- [Indico incomplete SSRF check in URL validation](https://junglewise.ai/threats/cve-2026-107394-indico-incomplete-server-side-request-forgery-ssrf-check)
- [PYSEC-2026-1461 - Indico vulnerable to Cross-Site Scripting via LaTeX math code](https://junglewise.ai/threats/cve-2025-59035-indico-vulnerable-to-cross-site-scripting-via-latex-math-code)