Vulnerability · Published Apr 23, 2026 · Assigned by GitHub_M
CVE-2026-41241pretalx: Stored cross-site scripting in organiser search typeahead
High 8.7
In plain English
A high-severity cross-site scripting in pretalx from pretalx. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submission titles, speaker display names, and user names/emails into the result dropdown using innerHTML string interpolation. Any user who controls one of those fields (which includes any registered user whose display name is looked up by an administrator) could include HTML or JavaScript that would execute in an organiser's browser when the organiser's search query matched the malicious record. This vulnerability is fixed in 2026.1.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | pretalx | 2026.1.0 | GHSA-cjcx-jfp2-f7m2 |
| PyPI | pretalx | 2026.1.0 | PYSEC-2026-108 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2 x_refsource_CONFIRM