Executive brief
Xapian is a search engine library used by applications to index and retrieve documents. The MSet::snippet() function, which generates search result excerpts for display in HTML, fails to escape HTML special characters in a specific code path when no highlight markers are provided and the text is short enough to fit within the requested length. An attacker can inject malicious HTML or JavaScript that will be rendered unescaped in search results, leading to stored cross-site scripting attacks against users viewing those results.
Technical details
This is a cross-site scripting (XSS) vulnerability caused by incomplete HTML escaping in the MSet::snippet() function in xapian-core/queryparser/termgenerator_internal.cc. The vulnerability exists in a fast-path optimization: when both highlight markers (hi_start and hi_end) are empty strings and the text length is within the requested limit, the function returns text directly without escaping, bypassing the escape logic in append_escaping_xml(). An attacker who can index untrusted content can inject markup (e.g., `<script>alert(1)</script>`) that will be returned unescaped by snippet(). The attack requires that the calling application uses empty highlight markers and relies on the documented HTML-escaping guarantee. Patches are available in xapian-core 1.4.32 and 2.0.1 and later.
Affected products
- Xapian xapian-core before 1.4.32 and before 2.1.0
Timeline
- 2026-08-11: disclosed: Initially reported to Xapian developers mailing list by Arpit Jain
- 2026-08-15: advisory: Debian bug report #1144490 filed
- 2026-08-20: patched: CVE-2026-77643 published; patches available in xapian-core 1.4.32 and 2.0.1