CVE-2026-57532
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
pretix
- Vendor
- pretix
- Product
- pretix
- Platforms
- Unknown
- Default status
unaffected- Package
- pretix
- Package collection
- https://pypi.python.org
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | affected | python | 2026.3.4 | Unavailable | None listed |
| 2026.4.0 | affected | python | 2026.4.4 | Unavailable | None listed |
| 2026.5.0 | affected | python | 2026.5.2 | Unavailable | None listed |