{"id":"DEBIAN-CVE-2026-77643","details":"A cross-site scripting vulnerability in  queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.","modified":"2026-09-12T10:00:31.058437368Z","published":"2026-08-20T22:18:06.207Z","upstream":["CVE-2026-77643"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-77643"}],"affected":[{"package":{"name":"xapian-core","ecosystem":"Debian:12","purl":"pkg:deb/debian/xapian-core?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.22-1","1.4.25-1","1.4.25-2","1.4.28-1","1.4.29-1","1.4.29-2","1.4.29-3","1.4.31-1","1.4.31-2","1.4.31-2~bpo13+1","1.4.32-1","1.4.32-1~bpo13+1","1.5.1-1","1.5.1-2","1.5.1-3","1.5.2-1","1.5.2-2","2.0.0-1","2.1.0-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77643.json"}},{"package":{"name":"xapian-core","ecosystem":"Debian:13","purl":"pkg:deb/debian/xapian-core?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.29-3+deb13u1"}]}],"versions":["1.4.29-3"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77643.json"}},{"package":{"name":"xapian-core","ecosystem":"Debian:14","purl":"pkg:deb/debian/xapian-core?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.32-1"}]}],"versions":["1.4.29-3","1.4.31-1","1.4.31-2","1.4.31-2~bpo13+1","1.4.32-1~bpo13+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-77643.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}