JLSEC-2026-1387 Medium 4.4

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian...

JLSEC Published: Aug 24, 2026
Modified: Aug 24, 2026
Severity: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Packages: xapian_jll *
Upstream: CVE-2026-77643 GHSA-955x-jgcw-hcxh EUVD-2026-63667

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

References

https://bugs.debian.org/1144490
https://github.com/advisories/GHSA-955x-jgcw-hcxh
https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html
https://nvd.nist.gov/vuln/detail/CVE-2026-77643
https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update