Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pretix | pip | >= 1.0.0, < 2025.7.3 | 2025.7.3 |
| pretix | pip | >= 2025.8.0, < 2025.8.2 | 2025.8.2 |
| pretix | pip | >= 2025.9.0, < 2025.9.2 | 2025.9.2 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in how pretix handles user-supplied data, such as names, when generating emails. The application uses placeholders in email templates (e.g., {name}) which are replaced with data provided by users. The core of the issue is that when rendering emails in HTML format, the placeholder replacement mechanism would interpret markdown and HTML within the user's data. An attacker could register with a name like [Click here for a discount](https://malicious.site), and this would be rendered as a clickable link in the email sent to them or other users, creating a significant phishing risk. The vulnerability was not a full cross-site scripting (XSS) issue due to a strict HTML tag allowlist, but it allowed for content injection that could deceive users.
The patch addresses this by introducing the bleach library to sanitize and "linkify" content during the placeholder replacement process. Specifically, when formatting content for HTML emails, a bleach.Linker instance is now used to find URLs and email addresses in the text and convert them into safe <a> tags, while escaping other potentially malicious HTML. The key changes are in pretix.base.email.MailRenderer.render, which now creates and passes a linkifier, and in pretix.helpers.format.SafeFormatter, which now uses this linkifier to process the data.
