Is CVE-2025-13742 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13742 being exploited in the wild.

How severe is CVE-2025-13742?

Medium severity, with a CVSS score of 6.1, published 27 November 2025.

Which products and versions are affected?

pretix (PyPI) ECOSYSTEM:introduced=1.0.0,fixed=2025.7.2, ECOSYSTEM:introduced=1.0.0,fixed=2025.7.3; Rami.Io Pretix >= 1.0.0, = 2025.8.0, = 2025.9.0, < 2025.9.2.

Is there a fix for CVE-2025-13742?

Yes. pretix (PyPI): upgrade to 2025.7.2, 2025.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-13742 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-13742?

Check whether you run Pretix, pretix (PyPI) or Rami.Io Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13742: rami.io pretix email content injection via attendee names

Q: Is there a fix for CVE-2025-13742?

Yes. pretix (PyPI): upgrade to 2025.7.2, 2025.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-13742 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-13742?

Check whether you run Pretix, pretix (PyPI) or Rami.Io Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13742 · Severity: medium · CVSS 6.1 · Published 2025-11-27

pretix, an open-source ticketing and event management platform, is vulnerable to a flaw where user-provided names are not properly cleaned before being included in automated emails. An attacker can use specially formatted names containing HTML or Markdown to inject links or custom text into emails sent by the system. While this cannot be used to take over the server, it allows attackers to create highly convincing phishing emails that appear to come from a trusted source.

Technologies: Pretix, pretix (PyPI), Rami.Io Pretix. Vendors: Pretix, PyPI, Rami.Io.

Quick answers

Is CVE-2025-13742 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13742 being exploited in the wild.
How severe is CVE-2025-13742?: Medium severity, with a CVSS score of 6.1, published 27 November 2025.
Which products and versions are affected?: pretix (PyPI) ECOSYSTEM:introduced=1.0.0,fixed=2025.7.2, ECOSYSTEM:introduced=1.0.0,fixed=2025.7.3; Rami.Io Pretix >= 1.0.0, < 2025.7.3; >= 2025.8.0, < 2025.8.2; >= 2025.9.0, < 2025.9.2.
Is there a fix for CVE-2025-13742?: Yes. pretix (PyPI): upgrade to 2025.7.2, 2025.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-13742 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-13742?: Check whether you run Pretix, pretix (PyPI) or Rami.Io Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pretix (PyPI): upgrade to 2025.7.2, 2025.7.3 or later
```
pip install "pretix>=2025.7.3"
```

Technical details

A content injection vulnerability exists in pretix due to improper encoding of user-supplied data in email templates. When placeholders like {name} are used, the system fails to strip or escape HTML and Markdown formatting provided by the user during registration. A remote, unauthenticated attacker can register with a crafted name to inject links or formatted text into emails sent to other users or administrators. While a strict HTML allow-list prevents Cross-Site Scripting (XSS), the flaw enables high-credibility phishing. The issue is fixed in versions 2025.7.3, 2025.8.2, and 2025.9.2.

Affected products

rami.io pretix >= 1.0.0, < 2025.7.3; >= 2025.8.0, < 2025.8.2; >= 2025.9.0, < 2025.9.2

Identifiers

CVE-2025-13742
GHSA-2mm6-624x-fqrr
PYSEC-2025-154

Timeline

2025-11-27: disclosed
2025-11-27: advisory
2025-11-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.