On Mon, Aug 24, 2026 at 08:57:02PM +0200, Peter Wienemann wrote: > Hi, > > On 2026-08-24 20:37:08, Pieter Lenaerts wrote: > > The beets web ui is very limited in its functions, it is not fit for > > external > > publication, number of users is probably very limited to begin with, attacks > > would be very unpractical. > > > > Therefore I think this is a very low risk vulnerability. > > > > I propose we contact upstream for a fix and backport this into the > > (old-)*stable distributions without treating this with special urgency. > > > > Do you agree with my assessment and proposed actions?
Agreed, there's no need for a DSA. It can either be fixed via a point release or we can also simply ignore it for stable entirely. > > @Alto angelo, would you like to contact upstream at their github repo > > https://github.com/beetbox/beets ? > > another option would be to patch out the bundled jquery.js and instead use > the file provided by the package libjs-jquery. That would be the best fix for forky indeed. Cheers, Moritz
