CVE-2026-42052: beets has a Cross-site Scripting vulnerability

April 29, 2026 (updated June 24, 2026)

During code logic analyis, an area that may lead to unintended behavior under specific conditions was discovered.

References

github.com/advisories/GHSA-3gxm-wfjx-m847
github.com/beetbox/beets/releases/tag/v2.10.0
github.com/beetbox/beets/security/advisories/GHSA-3gxm-wfjx-m847
lists.debian.org/debian-lts-announce/2026/06/msg00030.html
nvd.nist.gov/vuln/detail/CVE-2026-42052

Code Behaviors & Features

Detect and mitigate CVE-2026-42052 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →