Sorry, my debdiff was not created in the right way. This one looks better.
diff -Nru beets-2.2.0/debian/changelog beets-2.2.0/debian/changelog
--- beets-2.2.0/debian/changelog2025-04-13 23:38:58.0 +0200
+++ beets-2.2.0/debian/changelog2026-05-14 19:51:52.0 +0200
@@ -1,3 +1,11 @@
+beets (2.2.0-3+deb13u1) UNRELEASED; urgency=medium
+
+ * Add patch to fix xss vulnerability CVE-2026-42052 in web ui
+(Closes: #1135779)
+ * Add patch with test for unsafe web ui input
+
+ -- Pieter Lenaerts Thu, 14 May 2026 19:51:52 +0200
+
beets (2.2.0-3) unstable; urgency=medium
[ Florent 'Skia' Jacquet ]
diff -Nru beets-2.2.0/debian/patches/add_unit_test_checking_unsafe_web_ui_input
beets-2.2.0/debian/patches/add_unit_test_checking_unsafe_web_ui_input
--- beets-2.2.0/debian/patches/add_unit_test_checking_unsafe_web_ui_input
1970-01-01 01:00:00.0 +0100
+++ beets-2.2.0/debian/patches/add_unit_test_checking_unsafe_web_ui_input
2026-05-14 19:51:52.0 +0200
@@ -0,0 +1,100 @@
+From: Pieter Lenaerts
+Date: Sat, 9 May 2026 12:22:05 +0200
+Subject: Add unit test checking for unsafe input in web ui
+
+Forwarded: https://github.com/beetbox/beets/pull/6639
+---
+ test/plugins/test_web_xss.py | 84
+ 1 file changed, 84 insertions(+)
+ create mode 100644 test/plugins/test_web_xss.py
+
+diff --git a/test/plugins/test_web_xss.py b/test/plugins/test_web_xss.py
+new file mode 100644
+index 000..021122e
+--- /dev/null
b/test/plugins/test_web_xss.py
+@@ -0,0 +1,84 @@
++"""Tests for XSS vulnerability in the web plugin templates.
++
++This test verifies that the Underscore.js templates in index.html use
++the escaping syntax (<%- %) instead of the non-escaping syntax (<%= %).
++
++In Underscore.js 1.2.2 (used by beets):
++- <%= variable %> does NOT escape HTML (vulnerable to XSS)
++- <%- variable %> DOES escape HTML (safe)
++
++The test checks the index.html template file served by Flask to ensure
++all user data interpolations in the Underscore.js templates use the escaping
++syntax.
++
++Generated using mistral vibe, verified by Pieter Lenaerts
++"""
++
++import re
++
++from beets.test.helper import ItemInDBTestCase
++from beetsplug import web
++
++
++class WebXSSTest(ItemInDBTestCase):
++def setUp(self):
++super().setUp()
++web.app.config["TESTING"] = True
++web.app.config["lib"] = self.lib
++web.app.config["INCLUDE_PATHS"] = False
++web.app.config["READONLY"] = True
++self.client = web.app.test_client()
++
++def test_templates_use_escaping_syntax(self):
++"""Verify that all Underscore.js templates use <%- %> for escaping.
++
++This test requests the index.html page and checks that all
++user data interpolations in the Underscore.js templates use
++the escaping syntax (<%- %) rather than the non-escaping syntax (<%=
%).
++
++Before the fix (with <%= %>), this test will fail.
++After the fix (with <%- %>), this test will pass.
++"""
++# Request the index.html page
++response = self.client.get("/")
++html = response.data.decode("utf-8")
++
++# Extract the template scripts from the HTML
++# The templates are in blocks
++template_pattern = r'