# CVE-2026-107397: Indico Cross-Site-Scripting in minutes editor

Source: https://junglewise.ai/threats/cve-2026-107397-indico-cross-site-scripting-in-minutes-editor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107397 · Severity: medium · CVSS 4.4 · Published 2026-10-08

Indico is a conference management platform used to organize event scheduling, minutes, and attendee information. When multiple users edit meeting minutes concurrently, the conflict resolution UI fails to properly sanitize user input, allowing attackers to inject malicious scripts that execute in other users' browsers. This can lead to session hijacking, credential theft, or unauthorized actions on behalf of affected users.

Technologies: [Indico](https://junglewise.ai/threats/technologies/indico-indico), [indico (PyPI)](https://junglewise.ai/threats/technologies/indico). Vendors: [Indico](https://junglewise.ai/threats/vendors/indico), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-107397 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107397 being exploited in the wild.

**How severe is CVE-2026-107397?** Medium severity, with a CVSS score of 4.4, published 8 October 2026.

**Which products and versions are affected?** Indico before 3.3.13; indico (PyPI) < 3.3.13, ECOSYSTEM:introduced=0,fixed=3.3.13.

**Is there a fix for CVE-2026-107397?** Yes. indico (PyPI): upgrade to 3.3.13 or later. Until then: Enable Content Security Policy by setting CSP_ENABLED = True in indico.conf (recommended regardless of patching). Restrict minutes creation and editing to trustworthy users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107397 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-107397?** Check whether you run Indico or indico (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- indico (PyPI): upgrade to 3.3.13 or later

  ```sh
  pip install "indico>=3.3.13"
  ```


Enable Content Security Policy by setting CSP_ENABLED = True in indico.conf (recommended regardless of patching). Restrict minutes creation and editing to trustworthy users only.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the minutes editor conflict UI triggered during concurrent edits. It affects versions before 3.3.13 and requires authenticated access (low privilege), user interaction, and high attack complexity (deliberate concurrent editing). An attacker with the ability to edit minutes can inject script payloads that execute in the browsers of other users viewing the conflict resolution dialog, with scope change allowing impact beyond the vulnerable component.

## Affected products

- Indico Indico before 3.3.13

## Identifiers

- CVE-2026-107397
- GHSA-cw24-x4mj-fw3q
- PYSEC-2026-4228

## Timeline

- 2026-08-25: disclosed
- 2026-10-08: advisory

## References

- [https://github.com/indico/indico/security/advisories/GHSA-cw24-x4mj-fw3q](https://github.com/indico/indico/security/advisories/GHSA-cw24-x4mj-fw3q)

## Related threats

- [Indico cross-site scripting in link fields](https://junglewise.ai/threats/cve-2026-107396-indico-cross-site-scripting-in-link-fields)
- [Indico missing access check in legacy session export API](https://junglewise.ai/threats/cve-2026-107395-indico-missing-access-check-in-legacy-session-export-api)
- [Indico incomplete SSRF check in URL validation](https://junglewise.ai/threats/cve-2026-107394-indico-incomplete-server-side-request-forgery-ssrf-check)
- [PYSEC-2026-1461 - Indico vulnerable to Cross-Site Scripting via LaTeX math code](https://junglewise.ai/threats/cve-2025-59035-indico-vulnerable-to-cross-site-scripting-via-latex-math-code)
- [PYSEC-2026-1460 - Indico may disclose unauthorized user details access via legacy API](https://junglewise.ai/threats/cve-2025-59034-indico-may-disclose-unauthorized-user-details-access-via-legacy)