CVE-2025-13742 Limited HTML injection in emails
Attackers can inject HTML into emails via attendee names, enabling phishing by making malicious content appear trustworthy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-13742?
CVE-2025-13742 is a low-severity cross-site scripting vulnerability in pretix, published on 27 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this could not be abused for XSS or similarly dangerous attack chains. However, it can be used to manipulate emails in a way that makes user-provided content appear in a trustworthy and credible way, which can be abused for phishing.
Weakness: CWE-116
Which versions are affected by CVE-2025-13742?
7 open source packages ship an affected version, including pretix. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pretix PyPI | From 1.0.0 | 2025.7.2 |
pretix PyPI | From 1.0.0 | 2025.7.3 |
pretix PyPI | From 1.0.0 | 2025.7.3 |
pretix PyPI | From 2025.8.0 | 2025.8.2 |
pretix PyPI | From 2025.8.0 | 2025.8.2 |
pretix PyPI | From 2025.9.0 | 2025.9.2 |
1 more packages
pretix PyPI | From 2025.9.0 | 2025.9.2 |
Products include Pretix Pretix.
How do I fix CVE-2025-13742?
Upgrade pretix to a fixed version for your release line: 2025.7.2, 2025.7.3, 2025.8.2 or 2025.9.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-13742 being exploited?
There is no known exploitation of CVE-2025-13742 in the wild and no public exploit code.
Other vulnerabilities in pretix
Sources
Also known as GHSA-2mm6-624x-fqrr, PYSEC-2025-154.