VulnerabilityDeferred

CVE-2026-77643

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet().

MEDIUM 4.4EPSS 0.16%

Does this matter?

Lower severity and a low EPSS score (0.16%). Track it; it rarely justifies an emergency change on its own.

Description

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

CVSS 3.1: 4.4 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.16% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: cve@mitre.org

References

https://bugs.debian.org/1144490
https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html
https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.