CVE-2026-41241 Details

A stored cross-site scripting vulnerability has been identified in Pretalx versions prior to 2026.1.0. The issue arises in the organiser search feature of the Pretalx backend, where submission titles, speaker display names, and user names or emails are rendered into the results dropdown using innerHTML string interpolation. This allows any user who controls one of these fields, including registered users whose display names are accessed by an administrator, to inject HTML or JavaScript. The malicious script would execute in the organiser's browser when their search query matched the compromised record. Exploitation could lead to the execution of authenticated requests on behalf of the victim, including data modification requests, or the exfiltration of data visible to the victim.

Users can upgrade to Pretalx version 2026.1.0 or apply the patch manually to the 'src/pretalx/static/orga/js/base.js' file and re-collect static files.