CVE-2026-33046

Indico has a remote code execution vulnerability via server-side LaTeX rendering. Exploitation occurs through specially crafted LaTeX that bypasses the LaTeX sanitizer, enabling local file reads or code execution with the Indico server user privileges when XELATEX_PATH is set. Patches recommend u...