PyPI/pretix CVE-2025-13742: medium 6.1, EPSS 0.18%
pretix has Email Content Injection Through Maliciously Formatted Names
Action: Upgrade pretix to 2025.7.3 or later.
pip install pretix==2025.7.3pip install pretix==2025.8.2pip install pretix==2025.9.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 2025.7.3 | - |
| 2025.8.0 | 2025.8.2 | - |
| 2025.9.0 | 2025.9.2 | - |
Fixed versions
| 2025.7.3 | 2025.8.2 | 2025.9.2 |
Sources
- osv: GHSA-2mm6-624x-fqrr
- nvd: CVE-2025-13742
- https://github.com/pretix/pretix
- https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2025-154.yaml
- https://pretix.eu/about/en/blog/20251126-release-2025-9-1
- https://pretix.eu/about/en/security
- https://web.archive.org/web/20251129201933/https://pretix.eu/about/en/blog/20251127-release-2025-9-2
CVE-2025-13742 · published · modified · JSON