CVE-2026-107397: Indico: Cross-Site-Scripting in minutes editor

October 8, 2026

There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha’s shown when concurrent edits are made to the same minutes in an event.

References

github.com/advisories/GHSA-cw24-x4mj-fw3q
github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18
github.com/indico/indico/pull/7619
github.com/indico/indico/releases/tag/v3.3.13
github.com/indico/indico/security/advisories/GHSA-cw24-x4mj-fw3q
nvd.nist.gov/vuln/detail/CVE-2026-107397

Code Behaviors & Features

Detect and mitigate CVE-2026-107397 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →