6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42052

CVE-2026-42052: beets is Vulnerable to XSS

Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode <%= ... %> for untrusted metadata fields. In this runtime, <%= ... %> is raw insertion and HTML escaping is only performed by <%- ... %>. Rendered output is then inserted with .html(...), allowing attacker-controlled markup to become active DOM. This issue has been patched in version 2.10.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42052

CVE-2026-42052:

6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
beets	pip	< 2.10.0	2.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue within the 'web' plugin of the 'beets' music library manager. The root cause lies in the use of unsafe template rendering practices. Attacker-controlled data, such as song metadata (title, artist, lyrics, comments), was being rendered into HTML using Underscore.js templates with raw, unescaped interpolation tags (<%= ... %>).

The investigation pinpointed the fixing commit 75f0d8f4899e61afb939adf02dcfb078aed23a6a, which exclusively modifies the template file beetsplug/web/templates/index.html. The fix was to replace all instances of the raw interpolation tag <%= with the HTML-escaping tag <%-.

While the patch is applied to the template file, the actual execution of the vulnerability occurs within the JavaScript file beetsplug/web/static/beets.js. The vulnerability description and code analysis confirm that the render methods of three Backbone.js views (ItemView, ItemMainDetailView, and ItemExtraDetailView) are the sinks. These functions take the tainted data, apply the vulnerable templates, and then inject the resulting HTML into the DOM using jQuery's .html() method. Therefore, these three render functions are the specific runtime indicators that would appear in a profiler or stack trace during the exploitation of this vulnerability.

Vulnerable functions

ItemView.render

beetsplug/web/static/beets.js

The `ItemView.render` function uses an Underscore.js template to display item information. Prior to the patch, it used raw interpolation (`<%= ... %>`) for metadata fields like `artist`, `album`, and `title`. The rendered output was then inserted into the DOM using `$(this.el).html(...)`. This allowed an attacker to inject malicious HTML and JavaScript by crafting a metadata field, leading to a stored XSS vulnerability.

ItemMainDetailView.render

beetsplug/web/static/beets.js

Similar to `ItemView.render`, the `ItemMainDetailView.render` function rendered a template with unescaped data for fields like `artist`, `album`, and `title`. This output was then insecurely written to the DOM using `.html()`, making it vulnerable to stored XSS.

ItemExtraDetailView.render

beetsplug/web/static/beets.js

This function renders detailed metadata, including fields like `lyrics` and `comments`, which are common vectors for large XSS payloads. It used raw Underscore.js interpolation (`<%= ... %>`) and injected the result into the DOM via `.html()`. An attacker could store a malicious script in the lyrics or comments of a track, which would then be executed in the browser of any user viewing the track's details in the web UI.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.