Indico is an event management platform that allows users who can create or manage events to store custom URLs in content fields. Before version 3.3.13, these URLs can contain a javascript: scheme, which is persisted and subsequently rendered as a link. When a user follows that link, the embedded script executes in the victim’s browser with the Indico origin. This permits the attacker to read cookies, surreptitiously perform actions as the user, or redirect the browser to malicious sites, thereby compromising confidentiality and integrity. The flaw is a classic stored cross‑site scripting vulnerability. Because the attacker’s code runs in the context of the application’s domain, it can access authenticated session data and may be leveraged in phishing or credential‑stealing attacks. This vulnerability exposes all users who click links containing the embedded javascript: URL, including ordinary attendees who have no special privileges. No server‑side code is altered, so the impact is limited to the client side but still significant for user data and session security.

The affected product is the Indico event‑management platform running any release prior to 3.3.13. Users with roles that can manage events or upload speaker content—such as event managers, organizers, and speakers—can inject malicious URLs. All other users who click these URLs are at risk. The issue is addressed by upgrading to Indico version 3.3.13 or later, which removes the ability to store uncontrolled javascript links.

The CVSS score of 5.4 indicates moderate severity, with the EPSS score unavailable and the vulnerability not listed in the CISA KEV catalog. Attackers need to entice a victim into clicking a crafted link, a typical user‑prompted scenario. Once the script runs, it can steal session tokens, perform actions on behalf of the user, or redirect to phishing domains. Due to the lack of a readily exploitable remote code path on the server, the exploitation window relies on user interaction but offers a meaningful attack surface for credential theft and malicious redirects.