Pretalx XSS: Organizer Search Exposes User Data

The National Vulnerability Database reports CVE-2026-41241 in pretalx, a conference planning tool. Prior to version 2026.1.0, the backend’s organizer search feature was vulnerable to cross-site scripting (XSS). This flaw allowed malicious HTML or JavaScript to be injected into submission titles, speaker display names, and user names/emails. When an organizer’s search query matched a malicious record, the injected code would execute within their browser.

This is a classic stored XSS scenario, rated with a high CVSS score of 8.7. The attacker’s calculus is straightforward: leverage a low-privilege account (any registered user) to compromise a higher-privilege user (an organizer). The vulnerability resides in innerHTML string interpolation, a common pitfall that allows client-side code execution. For defenders, this means a compromised organizer account could lead to further internal access, data exfiltration, or even supply chain attacks if the conference content itself is sensitive.

The fix is available in pretalx version 2026.1.0. Organizations using pretalx must prioritize this update. Without it, the risk of an insider threat or targeted attack against conference organizers remains significant. This isn’t just about defacement; it’s about gaining a foothold into an organization via a seemingly innocuous administrative function.