Résumé
Indico: Cross-Site-Scripting in minutes editor
Détails de l’avis
Impact
There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event.
Patches
You should to update to Indico 3.3.13 as soon as possible. See the docs for instructions on how to update.
Workarounds
- Set
CSP_ENABLED = Trueinindico.conf- this is recommended regardless of updating. - Only let trustworthy users create content (including minutes which speakers can typically do as well) on Indico.
For more information
If you have any questions or comments about this advisory:
- Open a thread in our forum
- Email us privately at indico-team@cern.ch
Références
- https://github.com/advisories/GHSA-cw24-x4mj-fw3q
- https://github.com/indico/indico/security/advisories/GHSA-cw24-x4mj-fw3q
- https://nvd.nist.gov/vuln/detail/CVE-2026-107397
- https://github.com/indico/indico/pull/7619
- https://github.com/indico/indico/commit/d4c8c7127176efa4cb53c64119ca8ee2b551be18
- https://github.com/indico/indico/releases/tag/v3.3.13
Vulnérabilités liées
Tout Supply chain →- CRITICALCVE-2026-102989
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
- CRITICALCVE-2026-104252
Vitess vttablet /twopcz reflected XSS
- MEDIUMCVE-2026-104250
unstructured: Stored XSS via unescaped HTML generation
- HIGHCVE-2026-96230
Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability
- HIGHCVE-2026-108260
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
- CRITICALCVE-2026-107845
Contao: Cross-site scripting in the comments bundle