Executive brief
Beets, a media library management system, contains a vulnerability in its web interface that could allow an attacker to execute malicious scripts in a user's browser. By including specially crafted text in music metadata—such as song titles, lyrics, or comments—an attacker can trigger these scripts when a user views their library through the web UI. This could lead to the theft of sensitive information or unauthorized actions performed on behalf of the user.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the beets web plugin (beetsplug/web). The root cause is the use of raw Underscore.js template interpolation (<%= ... %>) instead of escaped interpolation (<%- ... %>) for untrusted metadata fields like title, lyrics, and comments. These rendered templates are subsequently inserted into the DOM using the jQuery .html() method in beets.js. An attacker can exploit this by providing a media file with malicious HTML/JavaScript in its metadata; when a victim views this item in the web UI, the payload executes in the context of the victim's browser session. The vulnerability is addressed in version 2.10.0.
Affected products
- beetbox beets < 2.10.0
Timeline
- 2026-04-29: disclosed
- 2026-04-29: advisory
- 2026-04-20: patched: Version 2.10.0 released