Xapian Core EUVD-2026-63667

Exploitation requires three concurrent conditions: (1) the attacker must hold at least low-privilege access sufficient to influence the content indexed by Xapian or the construction of search queries (PR:L per CVSS); (2) the deploying application must call Xapian::MSet::snippet() and render the returned HTML into a web page without a secondary escaping or sanitization step - applications that do not expose snippet() output in a browser context are not vulnerable; (3) a victim user must actively view the affected search results page (UI:R per CVSS). High attack complexity (AC:H) further limits exploitation: the attacker must craft input that triggers the specific missed corner case in the HTML escaping routine rather than the already-fixed general path. Applications using Xapian purely server-side for relevance ranking without rendering snippet() output in HTML are unaffected.

The NVD CVSS 3.1 score of 4.4 (AV:N/AC:H/PR:L/UI:R/S:C) accurately reflects this vulnerability's constrained real-world risk. Three factors suppress exploitability: high attack complexity (AC:H) requires hitting a specific corner case in the escaping logic; low privileges (PR:L) mean an attacker must be able to influence indexed content or query construction; and user interaction (UI:R) requires a victim to render the malicious snippet in a browser. The scope change (S:C) is notable and elevates severity slightly - successful exploitation crosses the trust boundary into the victim's browser session. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be independently assessed. The absence of a KEV listing and lack of reported POC code further reduce near-term urgency. Overall this is a real but lower-priority XSS in a library component, primarily relevant to web-facing applications built on Xapian that display snippet() output without a secondary sanitization layer.

An attacker with low-level access - such as the ability to submit documents for indexing or craft search queries - inserts content containing a specific HTML character sequence that the snippet() corner case fails to escape. When a victim user performs a search and the application renders the resulting snippet in their browser without further sanitization, the malicious payload executes as JavaScript in the victim's session. No public proof-of-concept code has been identified, but the root cause is documented and the earlier CVE-2018-0499 fix provides a partial roadmap for understanding the escaping logic.