The beets web plugin ships a bundled copy of jQuery at: beetsplug/web/static/jquery.js This version is below 3.5.0 and is vulnerable to XSS via DOM manipulation methods (CVE-2020-11022, CVE-2020-11023). Since beets actively serves this file to users via its web plugin interface, the XSS vulnerability is directly exploitable. Please update the bundled jQuery to 3.5.0 or later, or use the system libjs-jquery package instead. Reference: https://security-tracker.debian.org/tracker/CVE-2020-11022 Found by: Attack of the Clones GSoC 2026 pipeline (salsa.debian.org/rouca/gsoc2026) Gajendra Nath Soren gajendranath025@gmail.com
Dear Security Team, The beets web ui is very limited in its functions, it is not fit for external publication, number of users is probably very limited to begin with, attacks would be very unpractical. Therefore I think this is a very low risk vulnerability. I propose we contact upstream for a fix and backport this into the (old-)*stable distributions without treating this with special urgency. Do you agree with my assessment and proposed actions? @Alto angelo, would you like to contact upstream at their github repo https://github.com/beetbox/beets ? Best regards, Pieter
Sorry Alto Angelo. I forgot to thank you for your report. Thanks for taking the time to send in this bug. Pieter
Hi, another option would be to patch out the bundled jquery.js and instead use the file provided by the package libjs-jquery. Best regards Peter
Hi, btw, the beets.link read: ``` /usr/share/beets/beet /usr/bin/beet /usr/share/javascript/backbone/backbone.js /usr/share/beets/beetsplug/web/static/backbone.js /usr/share/javascript/jquery/jquery.js /usr/share/beets/beetsplug/web/static/jquery.js /usr/share/javascript/underscore/underscore.js /usr/share/beets/beetsplug/web/static/underscore.js ```
Okay, I just confirmed what eamanu brought up. beets.links and predecessors
have held those links since 2011 and they link to jquery 3.7.1 on my system.
Thanks eamanu!
I assume we can close this?
~ » LC_ALL=C dpkg --no-pager -l libjs-jquery pieter@leptop
+-- Desired=Unknown/Install/Remove/Purge/Hold
|+- Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
||+ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||| Name Version Architecture Description
+++-==============-====================-============-===============================================
ii libjs-jquery 3.7.1+dfsg+~3.5.33-1 all JavaScript library for dynamic web applications
---------------------------------------------------------------------------------------------------------
~ » ls /usr/share/beets/beetsplug/web/static -l pieter@leptop
totaal 16
lrwxrwxrwx 1 root root 43 3 aug 10:32 backbone.js -> ../../../../javascript/backbone/backbone.js
-rw-r--r-- 1 root root 2951 3 aug 10:32 beets.css
-rw-r--r-- 1 root root 9869 3 aug 10:32 beets.js
lrwxrwxrwx 1 root root 39 3 aug 10:32 jquery.js -> ../../../../javascript/jquery/jquery.js
lrwxrwxrwx 1 root root 47 3 aug 10:32 underscore.js -> ../../../../javascript/underscore/underscore.js
---------------------------------------------------------------------------------------------------------
~ » curl http://127.0.0.1:8337/static/jquery.js | head pieter@leptop
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 0/*!
* jQuery JavaScript Library v3.7.1
* https://jquery.com/
*
* Copyright OpenJS Foundation and other contributors
* Released under the MIT license
* https://jquery.org/license
*/
( function( global, factory ) {
curl: (23) Failure writing output to destination, passed 16384 returned 4096
---------------------------------------------------------------------------------------------------------
~ » pieter@leptop
Agreed, there's no need for a DSA. It can either be fixed via a point
release or we can also simply ignore it for stable entirely.
That would be the best fix for forky indeed.
Cheers,
Moritz
Upstream issue filed at: https://github.com/beetbox/beets/issues/6949 Gajendra