Every CVE Search/ Get API key

CVE-2026-77643

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian...

4.4 MediumFix available

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.25%Up 0.1 points since Aug 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.4

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Record
CVE-2026-77643
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2026-63667 4.4

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Record
EUVD-2026-63667
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-955x-jgcw-hcxh 4.4

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian...

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Record
GHSA-955x-jgcw-hcxh
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 4.4

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Record
CVE-2026-77643
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVDEBIAN-CVE-2026-77643 4.4

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Record
DEBIAN-CVE-2026-77643
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVJLSEC-2026-1387 4.4

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian...

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Record
JLSEC-2026-1387
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-4058 4.4

xapian-core security update

Xapian is an Open Source Search Engine Library, released under the GPL v2+. It is a highly adaptable toolkit which allows developers to easily add advanced indexing and search facilities to their own applications. It has built-in support for several families of weighting models and also supports a rich set of boolean query operators.

Security Fix(es):

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.(CVE-2026-77643)

Record
OESA-2026-4058
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-77643 4.4

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Record
UBUNTU-CVE-2026-77643
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVAZL-96924 No score

CVE-2026-77643 affecting package xapian-core 1.4.26-2

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Record
AZL-96924
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xapian-core
Azure Linux:3
 through 1.4.26-2 None known
xapian-core
Debian:12
 All versions, plus listed versions
1.4.22-11.4.25-11.4.25-21.4.28-11.4.29-1
Show 14 moreShow less
1.4.29-21.4.29-31.4.31-11.4.31-21.4.31-2~bpo13+11.4.32-11.4.32-1~bpo13+11.5.1-11.5.1-21.5.1-31.5.2-11.5.2-22.0.0-12.1.0-1
 None known
xapian-core
Debian:13
 before 1.4.29-3+deb13u1, plus listed versions
1.4.29-3
1.4.29-3+deb13u1
xapian-core
Debian:14
 before 1.4.32-1, plus listed versions
1.4.29-31.4.31-11.4.31-21.4.31-2~bpo13+11.4.32-1~bpo13+1
1.4.32-1
xapian_jll
Julia
 All versions None known
xapian-core
openEuler:24.03-LTS-SP1
 before 1.4.23-2.oe2403sp1
1.4.23-2.oe2403sp1
xapian-core
openEuler:24.03-LTS-SP3
 before 1.4.23-2.oe2403sp3
1.4.23-2.oe2403sp3
xapian-core
openEuler:24.03-LTS-SP4
 before 1.4.32-1.oe2403sp4
1.4.32-1.oe2403sp4
xapian-core
openEuler:20.03-LTS-SP4
 before 1.4.9-3.oe2003sp4
1.4.9-3.oe2003sp4
xapian-core
openEuler:22.03-LTS-SP4
 before 1.4.9-4.oe2203sp4
1.4.9-4.oe2203sp4
Show 7 moreShow less
Affected packages
PackageAffectedFixed
xapian-core
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.2.15-21.2.16-21.2.16-2ubuntu1
 None known
xapian-core
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.2.21-1.21.2.22-11.2.22-2
 None known
xapian-core
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.4.4-21.4.5-11.4.5-1ubuntu0.1
 None known
xapian-core
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.4.12-11.4.14-2
 None known
xapian-core
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4.18-3build11.4.18-4
 None known
xapian-core
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.4.22-11.4.22-1build1
 None known
xapian-core
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.4.29-31.4.29-3build11.4.31-2
 None known

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77643 is a medium vulnerability (CVSS 4.4) in Xapian Xapian-core, published August 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in xapian-core 1.4.29-3+deb13u1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open