# CVE-2026-101270: Pretix HTML injection in help text fields

Source: https://junglewise.ai/threats/cve-2026-101270-malicious-html-content-could-be-injected-into-the-help-texts-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-101270 · Severity: info · Published 2026-09-29

Pretix, an event ticketing and management platform, contains a stored cross-site scripting vulnerability where organizers can inject malicious HTML into help text fields. An attacker with organizer permissions could inject malicious content that executes in the browsers of end users viewing the help text, potentially stealing tickets, personal data, or session credentials.

Technologies: [Pretix](https://junglewise.ai/threats/technologies/pretix-pretix). Vendors: [Pretix](https://junglewise.ai/threats/vendors/pretix).

## Quick answers

**Is CVE-2026-101270 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101270 being exploited in the wild.

**How severe is CVE-2026-101270?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Pretix Pretix.

**Is there a fix for CVE-2026-101270?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101270 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-101270?** Check whether you run Pretix. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored HTML injection vulnerability exists in Pretix's help text functionality for various fields. An attacker with organizer-level permissions can inject arbitrary HTML/JavaScript into help text fields. The injected content is stored and executed in the browsers of users viewing these fields, enabling persistent cross-site scripting (XSS) attacks. The vulnerability requires authenticated access with organizer role.

## Affected products

- Pretix Pretix

## Timeline

- 2026-09-29: disclosed

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://pretix.eu/about/en/blog/20260929-release-2026-7-1/](https://pretix.eu/about/en/blog/20260929-release-2026-7-1/)

## Related threats

- [pretix missing permission check in ticket layout API](https://junglewise.ai/threats/cve-2026-125744-our-api-endpoint-for-changing-ticket-layouts-did-not-properly)
- [Pretix payment status validation bypass in Adyen integration](https://junglewise.ai/threats/cve-2026-101275-our-payment-integration-with-adyen-did-not-properly-validate)
- [pretix improper validation of OpenID Connect response_type in SSO](https://junglewise.ai/threats/cve-2026-101274-when-pretix-is-used-as-the-identity-provider-in-a-single-sign-on)
- [pretix gift card ID enumeration and account credit increase](https://junglewise.ai/threats/cve-2026-101273-some-of-our-api-endpoints-allowed-to-create-order-payments)
- [pretix session validation bypass in API-created shredder exports](https://junglewise.ai/threats/cve-2026-101272-the-mechanism-binding-files-generated-during-a-shredding-process)