CVE-2026-77643

Received Received - Intake

XSS in Xapian Core Due to Incomplete HTML Escaping

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: MITRE

Description

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-77643

EUVD

EUVD-2026-63667

Affected Vendors & Products

Vendor	Product	Version / Range
xapian	xapian-core	to 2.1.0 (exc)
xapian	xapian-core	to 1.4.32 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a cross-site scripting (XSS) vulnerability in Xapian's queryparser/termgenerator_internal.cc file. It occurs because Xapian::MSet::snippet() does not properly escape HTML in snippets, allowing malicious scripts to be injected. This is a missed case of a previous vulnerability (CVE-2018-0499).

Detection Guidance

This vulnerability is specific to Xapian's snippet generation in xapian-core. Detection requires checking the installed version of Xapian. Use commands like 'xapian-config --version' or 'dpkg -l | grep xapian-core' to verify if your version is before 1.4.32 or 2.1.0.

Impact Analysis

An attacker could exploit this to run malicious scripts in a user's browser when viewing search results. This could lead to session hijacking, data theft, or defacement of web pages. Users with limited privileges (PR:L) could be tricked into triggering the vulnerability via crafted input.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information (PHI) if exploited, risking compliance with security rules.

Mitigation Strategies

Upgrade Xapian xapian-core to version 2.1.0 or later, or to version 1.4.32 or later if using the 1.4.x branch. This addresses the incomplete HTML escaping issue in Xapian::MSet::snippet().

Hi! I’m here to help you understand CVE-2026-77643. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70