CVE-2026-77643: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-77643 is a cross-site scripting (XSS) vulnerability in Xapian xapian-core caused by incomplete HTML escaping in the Xapian::MSet::snippet() function, located in queryparser/termgenerator_internal.cc. It affects xapian-core versions before 1.4.32 (all prior versions) and versions 2.0.0 through before 2.1.0. The issue is a missed corner case of the previously patched CVE-2018-0499. It was published on August 20, 2026, with a CVSS v3.1 base score of 4.4 (Medium) (Github Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). The root cause is incomplete HTML escaping within the Xapian::MSet::snippet() function in queryparser/termgenerator_internal.cc, which fails to sanitize a specific corner case that was overlooked when CVE-2018-0499 was originally fixed. An authenticated, low-privileged attacker can craft input that, when processed by the snippet function and rendered in a web page, injects malicious JavaScript into the browser of another user who views the output. Exploitation requires user interaction (the victim must view the affected page) and has high attack complexity (Github Advisory).

Successful exploitation allows an attacker to inject and execute malicious scripts in the context of other users' browsers, potentially leading to session token theft, credential harvesting, or unauthorized actions performed on behalf of the victim. The scope is changed (cross-component), meaning the injected script can affect resources beyond the vulnerable component itself. Availability is not impacted, and both confidentiality and integrity impacts are rated low (Github Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with low privileges and victim user interaction, which further limits practical exploitability (Github Advisory).

1. Authenticate: Obtain low-privileged access to a web application that uses Xapian xapian-core (before 1.4.32 or 2.0.x before 2.1.0) to generate search result snippets via Xapian::MSet::snippet().
2. Craft malicious input: Submit a search query or index content containing an HTML/JavaScript payload that exploits the incomplete escaping corner case in termgenerator_internal.cc (e.g., a string that bypasses the existing HTML entity encoding logic).
3. Trigger snippet generation: Ensure the application renders the snippet output — for example, by having the malicious content indexed and then searched by another user.
4. Victim interaction: When a victim user performs a search that returns the crafted snippet, the unescaped payload executes in their browser, potentially stealing session cookies or performing actions on their behalf (Github Advisory).

• Logs: Web server or application logs showing unusual search queries containing HTML/JavaScript tags or encoded script payloads submitted by low-privileged users.
• Network: Outbound requests from victim browsers to attacker-controlled domains (e.g., for cookie exfiltration) following interaction with search result pages.
• Application: Unexpected JavaScript execution or browser alerts triggered on pages displaying Xapian-generated search snippets.

Upgrade xapian-core to version 1.4.32 or later (for the stable branch) or version 2.1.0 or later (for the development branch) to receive the fix (Github Advisory). As a complementary measure, implement Content Security Policy (CSP) headers on web applications using Xapian to limit the impact of any injected scripts. Conduct security testing of search snippet functionality to identify similar HTML escaping gaps.