CVE-2026-77643

A flaw was found in Xapian xapian-core. This cross-site scripting (XSS) vulnerability is due to incomplete HTML escaping by the Xapian::MSet::snippet() function. A remote attacker could exploit this by injecting malicious script, leading to arbitrary code execution in the user's browser context. This could result in information disclosure or session hijacking.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.