CVE-2026-77643

Published: Aug 20, 2026Modified: Sep 9, 2026Deferred

4.4

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.3 / Impact: 2.7

Source: MITRE (Secondary)

Description

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://bugs.debian.org/1144490

Source: cve@mitre.org

https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html

Source: cve@mitre.org

https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update

Source: cve@mitre.org

Timeline

No history available yet.