{"action":"Upgrade pretalx to 2026.1.0 or later.","affected":[{"fixed":"2026.1.0","introduced":"0"}],"component":"pretalx","cve_ids":["CVE-2026-41426"],"ecosystem":"PyPI","epss":0.00154,"exploited":false,"fixed_versions":["2026.1.0"],"ghsa_id":"GHSA-jm8c-9f3j-4378","id":"tcs_01M5KGQGMJBFVZX4PBS9M1GXMW","modified_at":"2026-05-20T09:19:11.385949Z","published_at":"2026-04-24T20:16:27.247Z","references":["https://osv.dev/vulnerability/PYSEC-2026-109","https://github.com/pretalx/pretalx/security/advisories/GHSA-jm8c-9f3j-4378"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-109","url":"https://osv.dev/vulnerability/PYSEC-2026-109"}],"summary":"pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered emails from a pretalx instance's configured sender address by embedding malformed"}