TI-2026-29850 Aliases CVE-2026-41241 GHSA-cjcx-jfp2-f7m2

pretalx: Stored cross-site scripting in organiser search typeahead

LOW 39CWE-79Published 2026-04-23 · Updated 2026-04-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submission titles, speaker display names, and user names/emails into the result dropdown using innerHTML string interpolation. Any user who controls one of those fields (which includes any registered user whose display name is looked up by an administrator) could include HTML or JavaScript that would execute in an organiser's browser when the organiser's search query matched the malicious record. This vulnerability is fixed in 2026.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00166 5th percentileScored 2026-11-07

Fix Fixed pretalx (pretalx): 2026.1.0pretalx (PyPI): 2026.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pretalx	pretalx	before 2026.1.0	2026.1.0	Patch available	CNA
—	pretalx (PyPI)	before 2026.1.0	2026.1.0	Patch available	GHSA-cjcx-jfp2-f7m2

pretalx Vendorpretalx Affected before 2026.1.0 Fixed in 2026.1.0 Patch available CNA
pretalx (PyPI) Vendor— Affected before 2026.1.0 Fixed in 2026.1.0 Patch available GHSA-cjcx-jfp2-f7m2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pretalx:pretalx::::::::	before 2026.1.0	Vulnerable	pretalx

cpe:2.3:a:pretalx:pretalx:*:*:*:*:*:*:*:* Versions before 2026.1.0 Vulnerable ·pretalx

Remediation

Fix · CNA pretalx (pretalx) Fixed in 2026.1.0
Fix · GHSA-cjcx-jfp2-f7m2 pretalx (PyPI) Fixed in 2026.1.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-41241
2026-10-03 Alias added: GHSA-cjcx-jfp2-f7m2

References

Advisory 2

Other 2

TI-2023-13000 pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). CVSS 3.1MEDIUM 6.5
TI-2023-12999 pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). CVSS 3.1MEDIUM 4.3
TI-2026-30025 pretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templates CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences