{"uuid": "f0cc2e22-9c39-42ce-a56e-c1807baf1577", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107397", "type": "seen", "source": "https://gist.github.com/alon710/24b163f07d21dde39b5cff6963abd23c", "content": "# CVE-2026-107397: CVE-2026-107397: Stored Cross-Site Scripting via Collaborative Editor Conflict Resolution and Custom Link Fields in Indico\n\n> **CVSS Score:** 4.4\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107397\n\n## Summary\nA technical analysis of CVE-2026-107397, a stored Cross-Site Scripting (XSS) vulnerability in Indico's collaborative notes editor and custom link generation fields. Prior to version 3.3.13, Marshmallow serialization schemas omitted HTML sanitization during conflict resolution, and form validators failed to enforce strict URI schemes, enabling authenticated low-privilege attackers to execute arbitrary JavaScript.\n\n## TL;DR\nVulnerabilities in Indico's conflict resolution interface and custom link fields allowed authenticated users to inject arbitrary HTML/JavaScript (Stored XSS). Fixed in version 3.3.13.\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.4 (Medium)\n- **Exploit Status**: None (No Public PoC)\n- **Impact**: Stored Cross-Site Scripting (XSS)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Indico collaborative minutes editor and custom link fields\n- **Indico**: < 3.3.13 (Fixed in: `3.3.13`)\n\n## Mitigation\n\n- Upgrade Indico to version 3.3.13 or newer.\n- Enforce strict Content Security Policy (CSP) headers in the Indico configuration to block inline scripts.\n- Deploy Web Application Firewall (WAF) rules to detect and block common XSS payload patterns on note editing endpoints.\n\n**Remediation Steps:**\n1. Activate the application's virtual environment.\n2. Run 'pip install --upgrade indico' to pull the patched version (3.3.13+).\n3. Restart the uwsgi and celery services to apply the code changes.\n4. Verify CSP settings in the indico.conf file to ensure 'CSP_ENABLED = True'.\n\n## References\n\n- [GitHub Security Advisory GHSA-cw24-x4mj-fw3q](https://github.com/indico/indico/security/advisories/GHSA-cw24-x4mj-fw3q)\n- [Indico Fix Commit d4c8c7127176efa4cb53c64119ca8ee2b551be18](https://github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18)\n- [Indico Release v3.3.13](https://github.com/indico/indico/releases/tag/v3.3.13)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107397) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T05:30:30.000000Z"}