From ba37f2eb472eef78bd2501ab4e3a1784008dcbec Mon Sep 17 00:00:00 2001
From: Mira Weller <weller@rami.io>
Date: Tue, 23 Jun 2026 21:57:05 +0200
Subject: [PATCH] [SECURITY] Fix XSS in ticket layout JSON (CVE-2026-57532)

---
 src/pretix/control/templates/pretixcontrol/pdf/index.html | 4 +---
 src/pretix/control/views/pdf.py                           | 2 +-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/pretix/control/templates/pretixcontrol/pdf/index.html b/src/pretix/control/templates/pretixcontrol/pdf/index.html
index 0935a6c127..814c1d37e5 100644
--- a/src/pretix/control/templates/pretixcontrol/pdf/index.html
+++ b/src/pretix/control/templates/pretixcontrol/pdf/index.html
@@ -19,9 +19,7 @@
         {% endif %}
     </h1>
 
-    <script type="application/json" id="editor-data">
-        {{ layout|safe }}
-    </script>
+    {{ layout|json_script:"editor-data" }}
     <div class="row">
         <div class="col-md-9">
             <div class="panel panel-default panel-pdf-editor">
diff --git a/src/pretix/control/views/pdf.py b/src/pretix/control/views/pdf.py
index 0ad4e1c0e2..6ec56a86b5 100644
--- a/src/pretix/control/views/pdf.py
+++ b/src/pretix/control/views/pdf.py
@@ -289,7 +289,7 @@ class BaseEditorView(EventPermissionRequiredMixin, TemplateView):
         ctx['pdf'] = self.get_current_background()
         ctx['variables'] = self.get_variables()
         ctx['images'] = self.get_images()
-        ctx['layout'] = json.dumps(self.get_current_layout())
+        ctx['layout'] = self.get_current_layout()
         ctx['title'] = self.title
         ctx['locales'] = [p for p in settings.LANGUAGES if p[0] in self.request.event.settings.locales]
         ctx['maxfilesize'] = self.maxfilesize