Executive brief
A vulnerability in the pretix-digital plugin for the pretix ticketing system allows for the injection of malicious HTML content. This could potentially be used to perform cross-site scripting (XSS) attacks, though the impact is mitigated by the application's security policies. If exploited, an attacker might attempt to mislead users or perform unauthorized actions within the user's browser session.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the pretix-digital plugin for pretix. The root cause is the failure to properly sanitize user-supplied input before rendering it in the plugin's output. An attacker with the ability to provide content to the plugin can inject malicious HTML/JavaScript. The severity is rated as low because the affected pages utilize a strong Content-Security-Policy (CSP), which significantly restricts the execution of unauthorized scripts. The issue was fixed in the June 2026 security release cycle (e.g., pretix 2026.5.2 and corresponding plugin updates).
Affected products
- pretix.eu pretix-digital All versions prior to 2026.5.2 release cycle updates
Timeline
- 2026-06-25: disclosed: Discovered internally by the pretix team.
- 2026-06-25: patched: Fixed versions released alongside pretix 2026.5.2.
- 2026-06-25: advisory