CVE-2026-41241 - Vulnerability Analysis

Overview

pretalx < 2026.1.0 contains a stored XSS caused by unsafe innerHTML interpolation of submission titles, speaker names, and user emails in organiser search results, letting any user execute JavaScript in organiser's browser, exploit requires organiser to perform search matching malicious input.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in organiser's browser, potentially stealing credentials or performing actions on behalf of the organiser.

Mitigation

Update to version 2026.1.0 or later.

References

• https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner