{"action":"Upgrade pretix to 2025.7.2 or later.","affected":[{"fixed":"2025.7.2","introduced":"1.0.0"}],"component":"pretix","cve_ids":["CVE-2025-13742"],"ecosystem":"PyPI","epss":0.00196,"exploited":false,"fixed_versions":["2025.7.2"],"ghsa_id":"GHSA-2mm6-624x-fqrr","id":"tcs_01M5KGNWNFB2RZ990RY49GHBZE","modified_at":"2026-06-10T17:01:37.478664702Z","published_at":"2025-11-27T11:15:47.760Z","references":["https://osv.dev/vulnerability/PYSEC-2025-154","https://pretix.eu/about/en/blog/20251126-release-2025-9-1/","https://github.com/advisories/GHSA-2mm6-624x-fqrr"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2025-154","url":"https://osv.dev/vulnerability/PYSEC-2025-154"}],"summary":"Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final em"}