CVE-2026-107396: Indico: Cross-Site-Scripting in link fields

October 8, 2026

There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs.

References

github.com/advisories/GHSA-c4wc-ggrj-jg9v
github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18
github.com/indico/indico/pull/7619
github.com/indico/indico/releases/tag/v3.3.13
github.com/indico/indico/security/advisories/GHSA-c4wc-ggrj-jg9v
nvd.nist.gov/vuln/detail/CVE-2026-107396

Code Behaviors & Features

Detect and mitigate CVE-2026-107396 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →