EUVD-2026-25273
GHSA-cjcx-jfp2-f7m2
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Authenticated user seeds stored payload (PR:L) that fires when an organiser searches (UI:R), crossing into the higher-privileged organiser session (S:C) with CSRF-token theft enabling read and write (C:H/I:H, A:N).
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submission titles, speaker display names, and user names/emails into the result dropdown using innerHTML string interpolation. Any user who controls one of those fields (which includes any registered user whose display name is looked up by an administrator) could include HTML or JavaScript that would execute in an organiser's browser when the organiser's search query matched the malicious record. This vulnerability is fixed in 2026.1.0.
AnalysisAI
Stored cross-site scripting in pretalx conference planning software before 2026.1.0 lets any registered user inject HTML/JavaScript via submission titles, speaker display names, or user names/emails, which executes in an organiser's browser when the organiser's typeahead search matches the malicious record. Because the backend rendered these fields into the search dropdown via innerHTML string interpolation, the injected script runs in the authenticated organiser context and can steal the CSRF token and perform actions on the victim's behalf. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but a scope-changing high-impact CVSS (8.7) and a vendor GHSA make this a credible privilege-escalation vector.
Technical ContextAI
pretalx is a Python/Django-based open-source tool for managing conference call-for-papers, scheduling, and speaker coordination; the affected component is the organiser backend's client-side search typeahead implemented in src/pretalx/static/orga/js/base.js. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): result rows for submission titles, speaker display names, and user names/emails were built by concatenating untrusted values directly into an innerHTML assignment rather than being escaped or set via textContent, so any markup in those stored fields is parsed as live DOM. The single affected CPE is cpe:2.3:a:pretalx:pretalx:*:*:*:*:*:*:*:* for all versions prior to 2026.1.0. This is a stored/persistent XSS because the payload lives in database-backed records (proposals, user profiles) and fires later when an organiser searches.
RemediationAI
Vendor-released patch: upgrade pretalx to 2026.1.0, which replaces the unsafe innerHTML interpolation in the organiser search typeahead; see the advisory at https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2. There is no configuration-level workaround. If you cannot upgrade immediately, the vendor's suggested compensating controls are to avoid using the organiser search bar entirely (trade-off: organisers lose typeahead lookup of proposals/speakers), or to manually apply the upstream fix to src/pretalx/static/orga/js/base.js and re-run static file collection (collectstatic) so the patched JavaScript is served (trade-off: requires re-collecting static assets and re-testing after deploy, and diverges from the tagged release until you upgrade). As additional defense, restrict organiser/admin accounts and review untrusted display names/proposal titles before performing searches.
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Rated medium severity (CVSS 4.3
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Rated medium severity (CVSS 6.5
Unauthenticated attackers can inject malicious HTML into user-controlled template placeholders in pretalx prior to 2026.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today