{"action":"Upgrade pretalx to 2026.1.0 or later.","affected":[{"fixed":"2026.1.0","introduced":"0"}],"component":"pretalx","cve_ids":["CVE-2026-41426"],"ecosystem":"PyPI","epss":0.00154,"exploited":false,"fixed_versions":["2026.1.0"],"ghsa_id":"GHSA-jm8c-9f3j-4378","id":"tcs_01M5KFP7WF6PM191QCQ5QBV34F","modified_at":"2026-06-08T19:15:13.810245726Z","published_at":"2026-04-18T01:11:19Z","references":["https://osv.dev/vulnerability/GHSA-jm8c-9f3j-4378","https://github.com/pretalx/pretalx/security/advisories/GHSA-jm8c-9f3j-4378","https://nvd.nist.gov/vuln/detail/CVE-2026-41426","https://github.com/pretalx/pretalx","https://github.com/pypa/advisory-database/tree/main/vulns/pretalx/PYSEC-2026-109.yaml"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-jm8c-9f3j-4378","url":"https://osv.dev/vulnerability/GHSA-jm8c-9f3j-4378"}],"summary":"pretalx mail templates vulnerable to email injection via unescaped user-controlled placeholders"}