Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode <%= ... %> for untrusted metadata fields. In this runtime, <%= ... %> is raw insertion and HTML escaping is only performed by <%- ... %>. Rendered output is then inserted with .html(...), allowing attacker-controlled markup to become active DOM. This issue has been patched in version 2.10.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-42052 Cross-Site Scripting in Beets Media Library Management System Below 2.10.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42052
Post summary
The post announces CVE-2026-42052 as an XSS flaw in Beets Media below v2.10.0, offering no PoC, exploit, or patch details.
CVE-2026-42052 Beets is the media library management system. Prior to version 2.10.0, the bundled web UI uses Underscore template interpolation mode <%= ... %> for untrusted metadat… https://www.cve.org/CVERecord?id=CVE-2026-42052
Post summary
The post highlights CVE‑2026‑42052 in Beets’ web UI, noting insecure underscore templating prior to v2.10.0 and implying that upgrading to the latest version mitigates the issue.