Limited HTML injection in emails
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this could not be abused for XSS or similarly dangerous attack chains. However, it can be used to manipulate emails in a way that makes user-provided content appear in a trustworthy and credible way, which can be abused for phishing.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pretix | pretix | 1.0.0 to before 2025.7.0; 2025.7.0 to before 2025.8.0; 2025.8.0 to before 2025.9.0; 2025.9.0 to before 2025.10.0 | 2025.10.0 | Patch available | CNA |
| — | pretix (PyPI) | 1.0.0 to before 2025.7.3 | 2025.7.3 | Patch available | GHSA-2mm6-624x-fqrr |
| — | pretix (PyPI) | 2025.8.0 to before 2025.8.2 | 2025.8.2 | Patch available | GHSA-2mm6-624x-fqrr |
| — | pretix (PyPI) | 2025.9.0 to before 2025.9.2 | 2025.9.2 | Patch available | GHSA-2mm6-624x-fqrr |
- pretix Vendorpretix Affected 1.0.0 to before 2025.7.0; 2025.7.0 to before 2025.8.0; 2025.8.0 to before 2025.9.0; 2025.9.0 to before 2025.10.0 Fixed in 2025.10.0 Patch available CNA
- pretix (PyPI) Vendor— Affected 1.0.0 to before 2025.7.3 Fixed in 2025.7.3 Patch available GHSA-2mm6-624x-fqrr
- pretix (PyPI) Vendor— Affected 2025.8.0 to before 2025.8.2 Fixed in 2025.8.2 Patch available GHSA-2mm6-624x-fqrr
- pretix (PyPI) Vendor— Affected 2025.9.0 to before 2025.9.2 Fixed in 2025.9.2 Patch available GHSA-2mm6-624x-fqrr
Remediation
- Fix · CNA pretix (pretix) Fixed in 2025.10.0
- Fix · GHSA-2mm6-624x-fqrr pretix (PyPI) Fixed in 2025.7.3 Advisory →
- Fix · GHSA-2mm6-624x-fqrr pretix (PyPI) Fixed in 2025.8.2 Advisory →
- Fix · GHSA-2mm6-624x-fqrr pretix (PyPI) Fixed in 2025.9.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13742
- 2026-10-03 Alias added: GHSA-2mm6-624x-fqrr
References
Advisory 2
Other 5
- https://github.com/pretix/pretix
- https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2025-154.yaml
- https://pretix.eu/about/en/blog/20251126-release-2025-9-1
- https://pretix.eu/about/en/security
- https://web.archive.org/web/20251129201933/https://pretix.eu/about/en/blog/20251127-release-2025-9-2
More Pretix vulnerabilities
- TI-2024-18268 pretix before 2024.1.1 mishandles file validation. CVSS 3.1CRITICAL 9.8
- TI-2026-02082 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
- TI-2026-02081 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
- TI-2026-02048 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
- TI-2024-07522 Stored XSS in Placeholder Samples in Mail Preview CVSS 4.0HIGH 7.2
- TI-2026-04908 A new API endpoint introduced in pretix 2025 that is supposed to return all check-in… CVSS 4.0MEDIUM 5.5
Sources
- CVE-2025-13742 · CVE Program
- CVE-2025-13742 · NVD
- FIRST EPSS
- GHSA-2mm6-624x-fqrr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences