CVE-2026-77643 Xapian CVE debrief

Who should care

Defenders responsible for Xapian xapian-core installations should assess exposure and prioritize patching. This includes reviewing and updating inventory of Xapian xapian-core installations, monitoring for potential cross-site scripting attacks, and implementing additional security measures such as input validation and output encoding. Security teams should also develop an incident response plan to address potential security breaches and review and update

Why it matters

Defenders should prioritize verifying and applying patches for Xapian xapian-core versions before 2.1.0 and 1.4.32 to prevent potential cross-site scripting attacks.

• Potential cross-site scripting attacks
• Verification of Xapian xapian-core versions and patches
• Monitoring for suspicious activity

Technical summary

The cross-site scripting vulnerability in Xapian xapian-core before 2.1.0 and 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). This vulnerability can be exploited by attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data breaches. The vulnerability is classified as MEDIUM with a CVSS score of 4.4. Defenders should prioritize verifying and applying patches for Xapian xapian-core versions before 2.1.0 and 1.4.32 to prevent potential cross-site scripting attacks.

Defensive priority

Defenders should prioritize verifying and applying patches for Xapian xapian-core versions before 2.1.0 and 1.4.32.

Recommended defensive actions

• Verify Xapian xapian-core version and apply patches if necessary
• Review and update inventory of Xapian xapian-core installations
• Monitor for potential cross-site scripting attacks
• Implement additional security measures such as input validation and output encoding
• Conduct regular security audits to identify potential vulnerabilities
• Develop an incident response plan to address potential security breaches
• Review and update security policies and procedures to ensure they are up-to-date and effective

Evidence notes

The CVE record and NVD entry provide details on the cross-site scripting vulnerability in Xapian xapian-core. The vulnerability is caused by incomplete HTML escaping in the Xapian::MSet::snippet() function. The CVE record was published on 2026-08-20T22:18:06.207Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its severity and potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.