CVE-2026-41241

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41241", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-18T03:47:03.135Z", "datePublished": "2026-04-23T18:30:56.991Z", "dateUpdated": "2026-04-23T19:23:19.257Z"}, "containers": {"cna": {"title": "pretalx: Stored cross-site scripting in organiser search typeahead", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2"}], "affected": [{"vendor": "pretalx", "product": "pretalx", "versions": [{"version": "< 2026.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-23T18:30:56.991Z"}, "descriptions": [{"lang": "en", "value": "pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submission titles, speaker display names, and user names/emails into the result dropdown using innerHTML string interpolation. Any user who controls one of those fields (which includes any registered user whose display name is looked up by an administrator) could include HTML or JavaScript that would execute in an organiser's browser when the organiser's search query matched the malicious record. This vulnerability is fixed in 2026.1.0."}], "source": {"advisory": "GHSA-cjcx-jfp2-f7m2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-23T19:23:11.646277Z", "id": "CVE-2026-41241", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T19:23:19.257Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41241", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-23T19:23:11.646277Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-23T19:23:14.481Z"}}], "cna": {"title": "pretalx: Stored cross-site scripting in organiser search typeahead", "source": {"advisory": "GHSA-cjcx-jfp2-f7m2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pretalx", "product": "pretalx", "versions": [{"status": "affected", "version": "< 2026.1.0"}]}], "references": [{"url": "https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2", "name": "https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submission titles, speaker display names, and user names/emails into the result dropdown using innerHTML string interpolation. Any user who controls one of those fields (which includes any registered user whose display name is looked up by an administrator) could include HTML or JavaScript that would execute in an organiser's browser when the organiser's search query matched the malicious record. This vulnerability is fixed in 2026.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-23T18:30:56.991Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41241", "state": "PUBLISHED", "dateUpdated": "2026-04-23T19:23:19.257Z", "dateReserved": "2026-04-18T03:47:03.135Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-23T18:30:56.991Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pretalx", "vendor": "pretalx", "versions": [{"status": "affected", "version": "< 2026.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pretalx:pretalx:*:*:*:*:*:*:*:*", "matchCriteriaId": "03EB5005-B230-44D1-ABC5-16C13DC4D187", "versionEndExcluding": "2026.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submission titles, speaker display names, and user names/emails into the result dropdown using innerHTML string interpolation. Any user who controls one of those fields (which includes any registered user whose display name is looked up by an administrator) could include HTML or JavaScript that would execute in an organiser's browser when the organiser's search query matched the malicious record. This vulnerability is fixed in 2026.1.0."}, {"lang": "es", "value": "pretalx es una herramienta de planificaci\u00f3n de conferencias. Antes de la versi\u00f3n 2026.1.0, la b\u00fasqueda del organizador en el backend de pretalx renderizaba los t\u00edtulos de las ponencias, los nombres de visualizaci\u00f3n de los ponentes y los nombres de usuario/correos electr\u00f3nicos en el men\u00fa desplegable de resultados utilizando la interpolaci\u00f3n de cadenas innerHTML. Cualquier usuario que controle uno de esos campos (lo que incluye a cualquier usuario registrado cuyo nombre de visualizaci\u00f3n sea consultado por un administrador) podr\u00eda incluir HTML o JavaScript que se ejecutar\u00eda en el navegador de un organizador cuando la consulta de b\u00fasqueda del organizador coincidiera con el registro malicioso. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2026.1.0."}], "id": "CVE-2026-41241", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41241", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-23T19:23:11.646277Z", "version": "2.0.3"}}]}, "published": "2026-04-23T19:17:29.533", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2026.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pretalx", "source": "cna", "vendor": "pretalx"}, "product": "pretalx", "vendor": "pretalx"}], "analysis": {"en": {"generated_at": "2026-04-28T14:47:07.654905+00:00", "value": {"mitigation_remediation": ["Upgrade to pretalx 2026.1.0 or later", "If upgrading is not immediately possible, disable the organizer search typeahead feature until a fix is applied", "Sanitize or HTML\u2011escape user\u2011supplied fields such as submission titles, speaker display names, and user names/emails in any custom code or templates"], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting in organizer search that can execute arbitrary JavaScript in organizers\u2019 browsers"}, "threat_synthesis": {"affected_systems": "All installations of pretalx before version 2026.1.0 are affected. The vulnerability exists on the backend component of the pre\u20112026.1.0 releases.", "description_and_impact": "Pretalx, a conference planning tool, contains a stored cross\u2011site scripting flaw in the organizer search typeahead. Submission titles, speaker display names, and user names/emails that are rendered with innerHTML allow any user who can set those fields\u2014such as a registered user whose display name is displayed to an organizer\u2014to embed HTML or JavaScript. When an organizer performs a search that matches the malicious record, the injected script runs inside the organizer\u2019s browser, enabling attackers to hijack sessions, exfiltrate data, or perform other malicious actions with the organizer\u2019s privileges.", "risk_and_exploitability": "The CVSS score of 8.7 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to control one of the affected fields and for an organizer to perform a matching search; the attack can be carried out via the web interface without additional privileges beyond those used to submit or assign speakers."}}}}, "created": "2026-04-27T23:15:05.843814+00:00", "updated": "2026-04-28T15:00:14.488594+00:00", "vendors": ["pretalx", "pretalx$PRODUCT$pretalx"]}