CVE-2026-41426 pretalx: Email injection via unescaped user-controlled placeholders in pretalx mail templates
An attacker can inject malicious HTML into email templates to send phishing emails from the legitimate sender address, bypassing email authentication checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41426?
CVE-2026-41426 is a medium-severity cross-site scripting vulnerability in pretalx, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered emails from a pretalx instance's configured sender address by embedding malformed HTML or markdown link syntax in a user-controlled template placeholder such as the account display name. The most direct vector is the password-reset flow: the attacker registers an account with a malicious name, enters the victim's email address, and triggers a password reset. The resulting email is delivered from the event's legitimate sender address and passes SPF/DKIM/DMARC validation, making it a ready-made phishing vector. This vulnerability is fixed in 2026.1.0.
Which versions are affected by CVE-2026-41426?
3 open source packages ship an affected version, including pretalx. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pretalx PyPI | All versions | 2026.1.0 |
pretalx PyPI | All versions | 2026.1.0 |
pretalx PyPI | All versions | 2026.1.0 |
Products include Pretalx Pretalx.
How do I fix CVE-2026-41426?
Upgrade pretalx to 2026.1.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-41426 being exploited?
There is no known exploitation of CVE-2026-41426 in the wild and no public exploit code.
Other vulnerabilities in pretalx
Sources
Also known as GHSA-jm8c-9f3j-4378, PYSEC-2026-109.