CVE-2026-41241: Pretalx Cross-Site Scripting Vulnerability

HIGH
Advisory Identifier: GHSA-cjcx-jfp2-f7m2
Share
CVSS 8.7
CWE-79
Published
Advisory Summary

CVE-2026-41241 is a HIGH (CVSS 8.7) cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Pretalx libraries in the PyPI ecosystem. The issue involves pretalx vulnerable to stored cross-site scripting in organizer search typeahead. Remediation is available by upgrading affected packages to version 2026.1.0.

CVE-2026-41241 at a Glance

CVE Identifier CVE-2026-41241
GHSA Identifier GHSA-cjcx-jfp2-f7m2
Severity HIGH
CVSS v3.1 Base Score 8.7
CWE Classification CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Product Pretalx
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 8.7

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity High (I:H)
Availability None (A:N)

How to Fix CVE-2026-41241

To remediate this vulnerability, upgrade all affected Pretalx dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pretalx fixed: 2026.1.0 
pip install pretalx>=2026.1.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show pretalx

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-41241, inspect your installed packages using pip:

pip show pretalx

Analyze the terminal output to locate any version of Pretalx in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2026.1.0), your application is affected.

Note: The pip show pretalx command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Pretalx, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

The organiser search in the pretalx backend rendered submission titles, speaker display names, and user names/emails into the result dropdown using `innerHTML` string interpolation. Any user who controls one of those fields (which includes any registered user whose display name is looked up by an administrator) could include HTML or JavaScript that would execute in an organiser's browser when the organiser's search query matched the malicious record. Triggering the vulnerability required: 1. An attacker-controlled field reachable by the search, which included any speaker's or submitter's display name in an event context (submitted a proposal) or any user at all for superusers. 2. An organiser user with more than just review permissions or administrator user performing a typeahead search whose query matched the malicious record. An attacker can make matches likely by placing common substrings in the payload-bearing field. Once triggered, the injected script executed in the context of the pretalx organiser interface and could read the page's CSRF token, submit authenticated requests on the victim's behalf (including requests modifying data due to access to the CSRF token), or exfiltrate data visible to the victim. ### Patches Fixed in pretalx v2026.1.0. ### Workarounds There is no configuration-level workaround. Operators who cannot upgrade immediately can avoid using the organiser search bar, or apply the patch to `src/pretalx/static/orga/js/base.js` manually and re-collect static files. ### Credits We thank Elad Meged from Novee Security for finding and reporting this vulnerability.

CVE-2026-41241 Affected Pretalx Versions

1 component(s)
Fixed Versions:
2026.1.0
Product / Package Ecosystem Affected Versions Fixed Version
pretalx
pypi/pretalx
PyPI
< 2026.1.0
2026.1.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2
NVD — CVE-2026-41241 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41241
Pretalx Source Repository REPOSITORY
https://github.com/pretalx/pretalx
Pretalx Source Repository REPOSITORY
https://github.com/pypa/advisory-database/tree/main/vulns/pretalx/PYSEC-2026-108.yaml

Frequently Asked Questions

What is CVE-2026-41241?
CVE-2026-41241 is a security vulnerability in Pretalx involving pretalx vulnerable to stored cross-site scripting in organizer search typeahead under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Which Pretalx versions are affected?
Affected versions include releases prior to 2026.1.0 across affected packages: pretalx.
What version fixes CVE-2026-41241?
Upgrading to 2026.1.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is pretalx affected?
Yes, pretalx is affected in releases prior to 2026.1.0. Upgrade your dependency to 2026.1.0 or later.
What is the CVSS score of CVE-2026-41241?
CVE-2026-41241 has a CVSS v3.1 base score of 8.7 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.
What CWE is associated with CVE-2026-41241?
CVE-2026-41241 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).
How can I check PyPI dependencies for CVE-2026-41241?
Run the dependency tree command: 'pip show pretalx'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cjcx-jfp2-f7m2",
  "modified" : "2026-06-08T19:03:21Z",
  "published" : "2026-04-18T01:11:38Z",
  "aliases" : [ "CVE-2026-41241" ],
  "summary" : "pretalx vulnerable to stored cross-site scripting in organizer search typeahead",
  "details" : "The organiser search in the pretalx backend rendered submission titles, speaker display names, and user names/emails into the result dropdown using `innerHTML` string interpolation. Any user who controls one of those fields (which includes any registered user whose display name is looked up by an administrator) could include HTML or JavaScript that would execute in an organiser's browser when the organiser's search query matched the malicious record.\n\nTriggering the vulnerability required:\n\n1. An attacker-controlled field reachable by the search, which included any speaker's or submitter's display name in an event context (submitted a proposal) or any user at all for superusers.\n2. An organiser user with more than just review permissions or administrator user performing a typeahead search whose query matched the malicious record. An attacker can make matches likely by placing common substrings in the payload-bearing field.\n\nOnce triggered, the injected script executed in the context of the pretalx organiser interface and could read the page's CSRF token, submit authenticated requests on the victim's behalf (including requests modifying data due to access to the CSRF token), or exfiltrate data visible to the victim.\n\n### Patches\n\nFixed in pretalx v2026.1.0.\n\n### Workarounds\n\nThere is no configuration-level workaround. Operators who cannot upgrade immediately can avoid using the organiser search bar, or apply the patch to `src/pretalx/static/orga/js/base.js` manually and re-collect static files.\n\n### Credits\n\nWe thank Elad Meged from Novee Security for finding and reporting this vulnerability.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "pretalx"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2026.1.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-41241"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pretalx/pretalx"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/pretalx/PYSEC-2026-108.yaml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-18T01:11:38Z",
    "nvd_published_at" : "2026-04-23T19:17:29Z"
  }
}