PyPI/indico CVE-2026-107396: medium 5.4, EPSS 0.19%

Indico: Cross-Site-Scripting in link fields

Action: Upgrade indico to 3.3.13 or later.

pip install indico==3.3.13

Affected

Fixed versions

Sources

• osv: GHSA-c4wc-ggrj-jg9v
• https://github.com/indico/indico/security/advisories/GHSA-c4wc-ggrj-jg9v
• https://nvd.nist.gov/vuln/detail/CVE-2026-107396
• https://github.com/indico/indico/pull/7619
• https://github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18
• https://github.com/indico/indico
• https://github.com/indico/indico/releases/tag/v3.3.13

CVE-2026-107396 · published 2026-10-08T22:09:41Z · modified 2026-10-15T14:56:15.886871416Z · JSON