Cross-Site Scripting Vulnerability in Beets Media Library Management System
CVE-2026-42052

6MEDIUM

Key Information:

Vendor

Beetbox

Status
Beets
Vendor
CVE Published:
4 May 2026

What is CVE-2026-42052?

The Beets Media Library Management System is susceptible to a Cross-Site Scripting (XSS) vulnerability due to improper handling of untrusted metadata fields in its web UI. Specifically, prior to version 2.10.0, the system utilized Underscore template interpolation mode <%= ... %> which permitted raw insertion of data without sufficient HTML escaping. This flaw allowed attacker-controlled markup to be executed in the active DOM when rendered output was inserted using .html(...). This vulnerability has been addressed in the updated version 2.10.0, reinforcing the security of the platform.

Affected Version(s)

beets < 2.10.0

References

https://github.com/beetbox/beets/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/beetbox/beets/releases/tag/v2.10.0
x_refsource_MISC

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.