CVE-2026-77643 in Xapian
Summary
by MITRE • 08/21/2026
A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in the Xapian search engine library, specifically within the queryparser/termgenerator_internal.cc module prior to versions 2.1.0 and 1.4.32, represents a critical cross-site scripting flaw rooted in insufficient input sanitization during text snippet generation. This issue is directly related to CVE-2018-0499, which addressed similar escaping deficiencies but failed to account for specific edge cases that remain exploitable here. The core technical failure lies within the Xapian::MSet::snippet() function, which is responsible for generating contextual text snippets from search results for display in user interfaces. When this function processes query terms or matched content, it fails to properly escape HTML special characters such as angle brackets, ampersands, and quotes under certain conditions involving complex term structures or specific encoding scenarios. This incomplete escaping allows an attacker who can influence the input data processed by the snippet generator to inject malicious script payloads that will be rendered directly in the victim's browser without proper sanitization.
From a technical perspective, this vulnerability is classified as CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting or XSS. The flaw occurs because the application does not adequately validate or encode user-supplied data before including it in HTML output. In the context of Xapian, which is often integrated into web applications to provide search functionality, this means that if an attacker can manipulate the search queries or the indexed content such that they trigger the vulnerable code path within termgenerator_internal.cc, any resulting snippet displayed on a webpage will contain executable JavaScript rather than plain text. This bypasses standard security controls because the browser interprets the injected script as part of the page's legitimate DOM structure, granting it access to cookies, session tokens, and other sensitive information associated with the user's current authentication state.
The operational impact of this vulnerability is significant for any web application relying on Xapian for search features that display snippets or highlighted terms in response to user queries. An attacker could craft a malicious URL containing specially constructed query parameters designed to exploit the incomplete HTML escaping logic. When an authenticated victim clicks this link, their browser will execute the injected script within the context of the vulnerable website's domain. This can lead to session hijacking, where the attacker steals the victim's authentication cookies and impersonates them to gain unauthorized access to accounts. It also enables phishing attacks by allowing the injection of fake login forms or deceptive UI elements that trick users into revealing credentials. Furthermore, in environments with less restrictive Content Security Policies, this vulnerability could facilitate more severe attacks such as keylogging or redirection to malicious sites, thereby compromising both user privacy and application integrity.
Mitigation strategies must focus on immediate patching and defensive coding practices. The primary remediation is to upgrade the Xapian library to version 2.1.0 or later for major releases, or version 1.4.32 and above for stable branches, as these versions contain fixes that address the missed corner cases identified in previous advisories like CVE-2018-0499. For applications unable to upgrade immediately due to compatibility constraints, developers should implement additional server-side input validation and output encoding layers specifically targeting the data passed to snippet generation functions. This involves ensuring that all special characters are HTML-encoded before being rendered in the browser context. Additionally, implementing a strict Content Security Policy with appropriate nonce or hash-based directives can mitigate the impact of successful XSS attempts by preventing unauthorized script execution even if injection occurs. Regular security audits and static code analysis focused on data flow to output sinks like snippet generators are recommended to detect similar vulnerabilities early in the development lifecycle.