web: update or remove bundled jQuery (CVE-2020-11022, CVE-2020-11023)
Author: NoTKanye23Created Aug 24, 2026Updated Sep 11, 2026
Labelsweb
The beets web plugin bundles jQuery 1.x at: beetsplug/web/static/jquery.js
This version is affected by XSS vulnerabilities fixed in jQuery 3.5.0:
- CVE-2020-11022
- CVE-2020-11023
Suggested fix: replace the bundled copy with a symlink to the system libjs-jquery package, following the pattern already used for backbone.js. This aligns with Debian packaging best practices.
Reported via Debian Bug#1145366. Reference: https://security-tracker.debian.org/tracker/CVE-2020-11022
Source: beetbox/beets