Skip to content
OpenAdvisories
Medium USN-8747-1 1 CVE

beets vulnerability

Published Sep 10, 2026 · Updated Sep 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Beets incorrectly escaped untrusted media metadata
in its web interface. An attacker could possibly use this issue to inject
arbitrary HTML or execute arbitrary JavaScript code in a user's browser.

Fixed packages 6

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS beets 1.3.8+dfsg-2ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS beets 1.4.6-2ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS beets 1.4.9-4ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS beets 1.6.0-1ubuntu0.1~esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS beets 1.6.0-8ubuntu0.1~esm1
Ubuntu · Pro 26.04 LTS Pro:26.04:LTS beets 2.5.1-4ubuntu0.1~esm1

Vulnerabilities 1

  • Medium 6.0
    CVE-2026-42052

    beets is Vulnerable to XSS

    Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode <%= ... %> for untrusted metadata fields. In this runtime, <%= ... %> is raw insertion and HTML escaping is only performed by…

    beetbox beets beets beets Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2026-42052