PT-2026-79220 · Unknown · Xapian-Core

CVE-2026-77643

·

Published

2026-08-20

·

Updated

2026-08-28

CVSS v3.1

4.4

Medium

VectorAV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions xapian-core versions prior to 2.1.0 xapian-core versions prior to 1.4.32
Description A cross-site scripting issue exists in queryparser/termgenerator internal.cc due to incomplete HTML escaping performed by the Xapian::MSet::snippet() function.
Recommendations Update xapian-core to version 2.1.0 or later. Update xapian-core to version 1.4.32 or later.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

AZL-96924
CVE-2026-77643
JLSEC-2026-1387

Affected Products

Xapian-Core