CVE-2025-13742
2 advisories.
PyPI/pretix CVE-2025-13742: low
pretix has Email Content Injection Through Maliciously Formatted Names
Action: Upgrade pretix to 2025.7.3 or later.
pip install pretix==2025.7.3pip install pretix==2025.8.2pip install pretix==2025.9.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 2025.7.3 | - |
| 2025.8.0 | 2025.8.2 | - |
| 2025.9.0 | 2025.9.2 | - |
Fixed versions
| 2025.7.3 | 2025.8.2 | 2025.9.2 |
Sources
- osv: GHSA-2mm6-624x-fqrr
- https://nvd.nist.gov/vuln/detail/CVE-2025-13742
- https://github.com/pretix/pretix
- https://github.com/pypa/advisory-database/tree/main/vulns/pretix/PYSEC-2025-154.yaml
- https://pretix.eu/about/en/blog/20251126-release-2025-9-1
- https://pretix.eu/about/en/security
- https://web.archive.org/web/20251129201933/https://pretix.eu/about/en/blog/20251127-release-2025-9-2
CVE-2025-13742 · published · modified · JSON
PyPI/pretix CVE-2025-13742: medium 6.1
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final em
Action: Upgrade pretix to 2025.7.2 or later.
pip install pretix==2025.7.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.0.0 | 2025.7.2 | - |
Fixed versions
| 2025.7.2 |
Sources
- osv: PYSEC-2025-154
- https://pretix.eu/about/en/blog/20251126-release-2025-9-1/
- https://github.com/advisories/GHSA-2mm6-624x-fqrr
CVE-2025-13742 · published · modified · JSON