p PatchFirst

CVE-2026-42052

CVE-2026-42052 · beets is Vulnerable to XSS

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode <%= ... %> for untrusted metadata fields. In this runtime, <%= ... %> is raw insertion and HTML escaping is only performed by <%- ... %>. Rendered output is then inserted with .html(...), allowing attacker-controlled markup to become active DOM. This issue has been patched in version 2.10.0.

CVSS 6.0 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • beets

    Versions
    • < 2.10.0: Affected

    No fix published

  • beets Debian:12

    Versions
    • 1.6.0-4
    Affected ranges
    • ECOSYSTEM: < 1.6.0-4+deb12u1

    Update to 1.6.0-4+deb12u1

  • beets Debian:13

    Versions
    • 2.2.0-3
    Affected ranges
    • ECOSYSTEM: < 2.2.0-3+deb13u1

    Update to 2.2.0-3+deb13u1

  • beets Debian:14

    Versions
    • 2.2.0-3
    • 2.5.1-1
    • 2.5.1-2
    • 2.5.1-3
    • 2.5.1-4
    • 2.6.2-1
    • 2.7.1-1
    • 2.8.0-1
    Affected ranges
    • ECOSYSTEM: < 2.11.0-1

    Update to 2.11.0-1

  • beets PyPI

    Versions
    • 1.0.0
    • 1.0b1
    • 1.0b10
    • 1.0b11
    • 1.0b12
    • 1.0b13
    • 1.0b14
    • 1.0b15
    • 1.0b2
    • 1.0b3
    • 1.0b4
    • 1.0b5
    • 1.0b6
    • 1.0b7
    • 1.0b8
    • 1.0b9
    • 1.0rc1
    • 1.0rc2
    • 1.1.0
    • 1.2.0
    • 1.2.1
    • 1.2.2
    • 1.3.0
    • 1.3.1
    • 1.3.10
    • 1.3.11
    • 1.3.12
    • 1.3.13
    • 1.3.14
    • 1.3.15
    • 1.3.16
    • 1.3.17
    • 1.3.18
    • 1.3.19
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.3.5
    • 1.3.6
    • 1.3.7
    • 1.3.8
    • 1.3.9
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.4.3
    • 1.4.4
    • 1.4.5
    • 1.4.6
    • 1.4.7
    • 1.4.8
    • 1.4.9
    • 1.5.0
    • 1.6.0
    • 1.6.1
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 2.3.1
    • 2.4.0
    • 2.5.0
    • 2.5.1
    • 2.6.0
    • 2.6.1
    • 2.6.2
    • 2.7.0
    • 2.7.1
    • 2.8.0
    • 2.9.0
    Affected ranges
    • ECOSYSTEM: < 2.10.0

    Update to 2.10.0

  • beets Ubuntu:Pro:16.04:LTS

    Versions
    • 1.3.8+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 1.3.8+dfsg-2ubuntu0.1~esm1

    Update to 1.3.8+dfsg-2ubuntu0.1~esm1

  • beets Ubuntu:Pro:18.04:LTS

    Versions
    • 1.3.19-2.1
    • 1.4.6-2
    Affected ranges
    • ECOSYSTEM: < 1.4.6-2ubuntu0.1~esm1

    Update to 1.4.6-2ubuntu0.1~esm1

  • beets Ubuntu:Pro:20.04:LTS

    Versions
    • 1.4.7-2
    • 1.4.7-2ubuntu1
    • 1.4.9-2
    • 1.4.9-4
    Affected ranges
    • ECOSYSTEM: < 1.4.9-4ubuntu0.1~esm1

    Update to 1.4.9-4ubuntu0.1~esm1

  • beets Ubuntu:Pro:22.04:LTS

    Versions
    • 1.4.9-7
    • 1.5.0-1
    • 1.6.0-1
    Affected ranges
    • ECOSYSTEM: < 1.6.0-1ubuntu0.1~esm1

    Update to 1.6.0-1ubuntu0.1~esm1

  • beets Ubuntu:Pro:24.04:LTS

    Versions
    • 1.6.0-4
    • 1.6.0-7
    • 1.6.0-8
    Affected ranges
    • ECOSYSTEM: < 1.6.0-8ubuntu0.1~esm1

    Update to 1.6.0-8ubuntu0.1~esm1

  • beets Ubuntu:25.10

    Versions
    • 2.2.0-2ubuntu1
    • 2.2.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • beets Ubuntu:Pro:26.04:LTS

    Versions
    • 2.2.0-3
    • 2.5.1-4
    Affected ranges
    • ECOSYSTEM: < 2.5.1-4ubuntu0.1~esm1

    Update to 2.5.1-4ubuntu0.1~esm1

Original sources

Check your server →