Is CVE-2026-41241 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41241 being exploited in the wild.

How severe is CVE-2026-41241?

High severity, with a CVSS score of 8.7, published 23 April 2026.

Which products and versions are affected?

pretalx (PyPI) < 2026.1.0, ECOSYSTEM:introduced=0,fixed=2026.1.0.

Is there a fix for CVE-2026-41241?

Yes. pretalx (PyPI): upgrade to 2026.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41241 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-41241?

Check whether you run Pretalx or pretalx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41241: pretalx stored XSS in organizer search typeahead

Q: Which products and versions are affected?

pretalx (PyPI) < 2026.1.0, ECOSYSTEM:introduced=0,fixed=2026.1.0.

Q: Is there a fix for CVE-2026-41241?

Yes. pretalx (PyPI): upgrade to 2026.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41241 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-41241?

Check whether you run Pretalx or pretalx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41241 · Severity: high · CVSS 8.7 · Published 2026-04-23

pretalx, a conference planning and management tool, is vulnerable to a security flaw in its organizer search feature. An attacker can submit a proposal or register a user account with a malicious name that, when searched for by a conference organizer, executes unauthorized code in the organizer's browser. This could allow the attacker to steal sensitive data, modify conference information, or perform actions on behalf of the administrator.

Technologies: pretalx (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-41241 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41241 being exploited in the wild.
How severe is CVE-2026-41241?: High severity, with a CVSS score of 8.7, published 23 April 2026.
Which products and versions are affected?: pretalx (PyPI) < 2026.1.0, ECOSYSTEM:introduced=0,fixed=2026.1.0.
Is there a fix for CVE-2026-41241?: Yes. pretalx (PyPI): upgrade to 2026.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41241 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-41241?: Check whether you run Pretalx or pretalx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pretalx (PyPI): upgrade to 2026.1.0 or later
```
pip install "pretalx>=2026.1.0"
```

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the pretalx organizer backend. The search typeahead functionality uses `innerHTML` string interpolation to render submission titles, speaker names, and user emails into the result dropdown without proper sanitization. An attacker can inject a malicious payload into these fields (e.g., by submitting a talk proposal). When an organizer or administrator performs a search that matches the malicious record, the script executes in their browser. This allows the attacker to bypass CSRF protections, exfiltrate data, or perform authenticated actions as the victim. The issue is fixed in version 2026.1.0 by properly escaping output in `src/pretalx/static/orga/js/base.js`.

Affected products

pretalx pretalx < 2026.1.0

Identifiers

CVE-2026-41241
GHSA-cjcx-jfp2-f7m2
PYSEC-2026-108

Timeline

2026-04-17: disclosed
2026-04-17: patched: Fixed in version 2026.1.0
2026-04-18: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.