{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77643", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-08-20T21:23:30.985Z", "datePublished": "2026-08-20T21:23:31.317Z", "dateUpdated": "2026-08-28T18:08:32.929Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "xapian-core", "vendor": "Xapian", "versions": [{"lessThan": "2.1.0", "status": "affected", "version": "2.0.0", "versionType": "semver"}, {"lessThan": "1.4.32", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting vulnerability in \nqueryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of\u00a0CVE-2018-0499."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-08-20T21:23:31.317Z"}, "references": [{"url": "https://bugs.debian.org/1144490"}, {"url": "https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html"}, {"url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.1.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:xapian:xapian-core:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.32"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-28T18:08:22.966488Z", "id": "CVE-2026-77643", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T18:08:32.929Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "xapian-core", "vendor": "Xapian", "versions": [{"lessThan": "2.1.0", "status": "affected", "version": "2.0.0", "versionType": "semver"}, {"lessThan": "1.4.32", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A cross-site scripting vulnerability in \nqueryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of\u00a0CVE-2018-0499."}], "id": "CVE-2026-77643", "lastModified": "2026-08-28T20:19:56.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77643", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-28T18:08:22.966488Z", "version": "2.0.3"}}]}, "published": "2026-08-20T22:18:06.207", "references": [{"source": "cve@mitre.org", "url": "https://bugs.debian.org/1144490"}, {"source": "cve@mitre.org", "url": "https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html"}, {"source": "cve@mitre.org", "url": "https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "xapian-core: Xapian xapian-core: Arbitrary code execution via incomplete HTML escaping", "id": "2520814", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520814"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A cross-site scripting vulnerability in \nqueryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of\u00a0CVE-2018-0499.", "A flaw was found in Xapian xapian-core. This cross-site scripting (XSS) vulnerability is due to incomplete HTML escaping by the Xapian::MSet::snippet() function. A remote attacker could exploit this by injecting malicious script, leading to arbitrary code execution in the user's browser context. This could result in information disclosure or session hijacking."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-77643", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "xapian-core", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "xapian-core", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "xapian-core", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-20T21:23:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-77643\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77643\nhttps://bugs.debian.org/1144490\nhttps://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html\nhttps://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.1.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.32)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "xapian-core", "source": "cna", "vendor": "Xapian"}, "product": "xapian-core", "vendor": "xapian"}], "created": "2026-08-20T23:00:06.749353+00:00", "title": "Cross\u2011Site Scripting via Incomplete HTML Escaping in Xapian Core Query Parser", "updated": "2026-08-21T01:00:04.536108+00:00", "vendors": ["xapian", "xapian$PRODUCT$xapian-core"]}