CVE-2025-59035
Description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.
How to fix
- cern indico3.3.8 or later
- indico3.3.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cern indico | v < 3.3.8 | 3.3.8 |
| indicoPyPI | v < 3.3.8 | 3.3.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.