Homepage
About Snyk

pretix@2024.6.1 vulnerabilities

Reinventing presales, one ticket at a time

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the pretix package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • L
Cross-site Scripting (XSS)

pretix is a Reinventing presales, one ticket at a time

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the control panel due to improper user input sanitization in the placeholders (like {name} or {event}). An attacker can inject HTML tags into email previews on the settings page by exploiting this vulnerability.

NOTE:

This is only exploitable if a Content Security Policy (CSP) bypass occurs.

How to fix Cross-site Scripting (XSS)?

Upgrade pretix to version 2024.7.1 or higher.

[,2024.7.1)
Go back to all versions of this package