The vulnerability lies in the web UI of Beets, which uses Underscore template interpolation mode <%= ... %> for rendering metadata fields. In this mode raw data is inserted without HTML escaping, which permits attacker‑controlled markup to be embedded into the page. The generated output is then inserted into the DOM with .html(...), allowing scripts to execute in the browser. This flaw is a classic cross‑site scripting vulnerability (CWE‑79).

Beets versions prior to 2.10.0 are affected. The vendor product identified by the CNA is beetbox:beets. Installing any version older than 2.10.0 exposes the web UI to this XSS risk.

The CVSS score of 6 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The attack requires that an attacker can supply or modify metadata that the web UI renders; once the vulnerable UI displays the injected markup, the script runs in the victim’s browser context. The risk is therefore confined to situations where the attacker can influence the metadata and the affected user interacts with the rendered page.