pretix-tracking-scripts (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-2415 via pretix (2024.11.0)

pretix PYPI version 2024.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on pretix and may be impacted: - pretix-tracking-scripts =1.0.0, =1.0.1 Source cves: CVE-2026-2415 Source advisory: OSV:GHSA-R8P8-QW9W-J9QV...

pretix-tracking-scripts (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-2415 via pretix (2024.11.0)

pretix PYPI version 2024.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on pretix and may be impacted: - pretix-tracking-scripts =1.0.0, =1.0.1 Source cves: CVE-2026-2415 Source advisory: OSV:PYSEC-2026-110...

CVE-2026-2415

The CVE-2026-2415 affects pretix email templates where placeholders are rendered insecurely. Two issues are described: (1) information exfiltration via malicious placeholder names (e.g., {{event.init .code .co_filename}}) that can leak config data, including passwords or API keys, due to incomple...