Is CVE-2026-107397 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107397 being exploited in the wild.

How severe is CVE-2026-107397?

Medium severity, with a CVSS score of 4.4, published 8 October 2026.

Which products and versions are affected?

Indico before 3.3.13; indico (PyPI) < 3.3.13, ECOSYSTEM:introduced=0,fixed=3.3.13.

How is CVE-2026-107397 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107397?

Check whether you run Indico or indico (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107397: Indico Cross-Site-Scripting in minutes editor

Q: Is there a fix for CVE-2026-107397?

Yes. indico (PyPI): upgrade to 3.3.13 or later. Until then: Enable Content Security Policy by setting CSP_ENABLED = True in indico.conf (recommended regardless of patching). Restrict minutes creation and editing to trustworthy users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107397 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-107397?

Check whether you run Indico or indico (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107397 · Severity: medium · CVSS 4.4 · Published 2026-10-08

Indico is a conference management platform used to organize event scheduling, minutes, and attendee information. When multiple users edit meeting minutes concurrently, the conflict resolution UI fails to properly sanitize user input, allowing attackers to inject malicious scripts that execute in other users' browsers. This can lead to session hijacking, credential theft, or unauthorized actions on behalf of affected users.

Technologies: Indico, indico (PyPI). Vendors: Indico, PyPI.

Quick answers

Is CVE-2026-107397 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107397 being exploited in the wild.
How severe is CVE-2026-107397?: Medium severity, with a CVSS score of 4.4, published 8 October 2026.
Which products and versions are affected?: Indico before 3.3.13; indico (PyPI) < 3.3.13, ECOSYSTEM:introduced=0,fixed=3.3.13.
Is there a fix for CVE-2026-107397?: Yes. indico (PyPI): upgrade to 3.3.13 or later. Until then: Enable Content Security Policy by setting CSP_ENABLED = True in indico.conf (recommended regardless of patching). Restrict minutes creation and editing to trustworthy users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107397 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107397?: Check whether you run Indico or indico (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

indico (PyPI): upgrade to 3.3.13 or later
```
pip install "indico>=3.3.13"
```

Enable Content Security Policy by setting CSP_ENABLED = True in indico.conf (recommended regardless of patching). Restrict minutes creation and editing to trustworthy users only.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the minutes editor conflict UI triggered during concurrent edits. It affects versions before 3.3.13 and requires authenticated access (low privilege), user interaction, and high attack complexity (deliberate concurrent editing). An attacker with the ability to edit minutes can inject script payloads that execute in the browsers of other users viewing the conflict resolution dialog, with scope change allowing impact beyond the vulnerable component.

Affected products

Indico Indico before 3.3.13

Identifiers

CVE-2026-107397
GHSA-cw24-x4mj-fw3q
PYSEC-2026-4228

Timeline

2026-08-25: disclosed
2026-10-08: advisory

References

https://github.com/indico/indico/security/advisories/GHSA-cw24-x4mj-fw3q

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.