CVE-2026-77643: Xapian Xapian-Core

Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days.

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Affected products

• Xapian Xapian-Core: from 2.0.0, before 2.1.0 (fixed in 2.1.0); before 1.4.32 (fixed in 1.4.32)

Published 2026-08-20. Last modified 2026-09-09.