Executive brief
pretalx, a conference planning and management tool, is vulnerable to a security flaw in its organizer search feature. An attacker can submit a proposal or register a user account with a malicious name that, when searched for by a conference organizer, executes unauthorized code in the organizer's browser. This could allow the attacker to steal sensitive data, modify conference information, or perform actions on behalf of the administrator.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the pretalx organizer backend. The search typeahead functionality uses `innerHTML` string interpolation to render submission titles, speaker names, and user emails into the result dropdown without proper sanitization. An attacker can inject a malicious payload into these fields (e.g., by submitting a talk proposal). When an organizer or administrator performs a search that matches the malicious record, the script executes in their browser. This allows the attacker to bypass CSRF protections, exfiltrate data, or perform authenticated actions as the victim. The issue is fixed in version 2026.1.0 by properly escaping output in `src/pretalx/static/orga/js/base.js`.
Affected products
- pretalx pretalx < 2026.1.0
Timeline
- 2026-04-17: disclosed
- 2026-04-17: patched: Fixed in version 2026.1.0
- 2026-04-18: advisory