Phishing via rendered attendee-name markup

HTML injection in affected pretix releases allows remote attackers to place trusted-looking links in emails through crafted attendee names. The email placeholder substitution path interprets HTML or Markdown in customer-controlled attendee names and inserts the allowlisted result into outgoing HTML messages instead of treating the name as plain text. Exploitation requires control of an attendee name and a recipient who trusts and acts on the injected content; the tag allowlist blocks script execution, limiting the reported consequence to email manipulation and phishing.