CVE-2025-59035 Indico vulnerable to Cross-Site Scripting via LaTeX math code
Attackers can inject malicious scripts via LaTeX math in event descriptions, potentially compromising user sessions and data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-59035?
CVE-2025-59035 is a medium-severity cross-site scripting vulnerability in indico, published on 10 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as soon as possible. As a workaround, only let trustworthy users create content on Indico. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.
Weakness: CWE-79
Which versions are affected by CVE-2025-59035?
3 open source packages ship an affected version, including indico. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
indico PyPI | All versions | 3.3.8 |
indico PyPI | All versions | 3.3.8 |
indico PyPI | All versions | 3.3.8 |
Products include Cern Indico.
How do I fix CVE-2025-59035?
Upgrade indico to 3.3.8 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-59035 being exploited?
There is no known exploitation of CVE-2025-59035 in the wild and no public exploit code.
Other vulnerabilities in indico
- CVE-2026-33046 Indico discloses local files resulting in Remote Code Execution through LaTeX injection
- CVE-2021-30185 Indico Tampering with links (e.g. password reset) in sent emails
- CVE-2026-25738 Indico has Server-Side Request Forgery (SSRF) in multiple places
- CVE-2026-28352 Indico missing access check in event series management API
- CVE-2026-25739 Indico affected by Cross-Site-Scripting via material uploads
Sources
Also known as GHSA-7cf7-9wrr-vrf4, PYSEC-2026-1461.