{"id":"UBUNTU-CVE-2026-77643","details":"A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.","modified":"2026-09-02T19:36:34.327128484Z","published":"2026-08-20T22:18:00Z","upstream":["CVE-2026-77643"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-77643"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-77643"},{"type":"REPORT","url":"https://lists.xapian.org/pipermail/xapian-devel/2026-August/003429.html"},{"type":"REPORT","url":"https://trac.xapian.org/wiki/SecurityFixes/2018-07-02#a2026-08-13update"}],"affected":[{"package":{"name":"xapian-core","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/xapian-core?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.15-2","1.2.16-2","1.2.16-2ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libxapian22","binary_version":"1.2.16-2ubuntu1"},{"binary_version":"1.2.16-2ubuntu1","binary_name":"xapian-examples"},{"binary_name":"xapian-tools","binary_version":"1.2.16-2ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77643.json"}},{"package":{"name":"xapian-core","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/xapian-core?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.21-1.2","1.2.22-1","1.2.22-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libxapian22v5","binary_version":"1.2.22-2"},{"binary_version":"1.2.22-2","binary_name":"xapian-examples"},{"binary_name":"xapian-tools","binary_version":"1.2.22-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77643.json"}},{"package":{"name":"xapian-core","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/xapian-core?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.4-2","1.4.5-1","1.4.5-1ubuntu0.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libxapian30","binary_version":"1.4.5-1ubuntu0.1"},{"binary_version":"1.4.5-1ubuntu0.1","binary_name":"xapian-examples"},{"binary_version":"1.4.5-1ubuntu0.1","binary_name":"xapian-tools"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77643.json"}},{"package":{"name":"xapian-core","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/xapian-core?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.12-1","1.4.14-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libxapian30","binary_version":"1.4.14-2"},{"binary_name":"xapian-examples","binary_version":"1.4.14-2"},{"binary_name":"xapian-tools","binary_version":"1.4.14-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77643.json"}},{"package":{"name":"xapian-core","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/xapian-core?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.18-3build1","1.4.18-4"],"ecosystem_specific":{"binaries":[{"binary_name":"libxapian30","binary_version":"1.4.18-4"},{"binary_name":"xapian-examples","binary_version":"1.4.18-4"},{"binary_name":"xapian-tools","binary_version":"1.4.18-4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77643.json"}},{"package":{"name":"xapian-core","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/xapian-core?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.22-1","1.4.22-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libxapian30","binary_version":"1.4.22-1build1"},{"binary_version":"1.4.22-1build1","binary_name":"xapian-examples"},{"binary_name":"xapian-tools","binary_version":"1.4.22-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77643.json"}},{"package":{"name":"xapian-core","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/xapian-core?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.29-3","1.4.29-3build1","1.4.31-2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.4.31-2","binary_name":"libxapian30"},{"binary_name":"xapian-examples","binary_version":"1.4.31-2"},{"binary_name":"xapian-tools","binary_version":"1.4.31-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77643.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N"},{"type":"Ubuntu","score":"medium"}]}