{"action":"Upgrade pretalx to 2026.1.0 or later.","affected":[{"fixed":"2026.1.0","introduced":"0"}],"component":"pretalx","cve_ids":["CVE-2026-41241"],"ecosystem":"PyPI","epss":0.00166,"exploited":false,"fixed_versions":["2026.1.0"],"ghsa_id":"GHSA-cjcx-jfp2-f7m2","id":"tcs_01M5KGQEVYPJZSXTPKFG3EGMH0","modified_at":"2026-05-20T09:19:11.332615Z","published_at":"2026-04-23T19:17:29.533Z","references":["https://osv.dev/vulnerability/PYSEC-2026-108","https://github.com/pretalx/pretalx/security/advisories/GHSA-cjcx-jfp2-f7m2"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-108","url":"https://osv.dev/vulnerability/PYSEC-2026-108"}],"summary":"pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submission titles, speaker display names, and user names/emails into the result dropdown"}