CVE-2025-59035: Indico vulnerable to Cross-Site Scripting via LaTeX math code

September 10, 2025

There is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions.

References

github.com/advisories/GHSA-7cf7-9wrr-vrf4
github.com/indico/indico
github.com/indico/indico/releases/tag/v3.3.8
github.com/indico/indico/security/advisories/GHSA-7cf7-9wrr-vrf4
nvd.nist.gov/vuln/detail/CVE-2025-59035

Code Behaviors & Features

Detect and mitigate CVE-2025-59035 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →