Threats affecting pkg:github/venueless/venueless

CVE-2026-82838 is a medium severity vulnerability in the pretix venueless product where the default docker image did not properly prevent uploaded SVG files from containing executable JavaScript. This issue relates to improper neutralization of script-related HTML tags (CWE-80). A valid Content Security Policy is now set to mitigate this risk. No specific affected versions or patches are currently detailed.

An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.

Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.