A cross‑site scripting flaw exists in the file queryparser/termgenerator_internal.cc of Xapian xapian‑core prior to version 2.1.0 and before 1.4.32 because the routine Xapian::MSet::snippet() does not perform sufficient HTML escaping. A malicious user can supply a crafted query that causes the snippet to contain executable script when rendered in a web page, enabling the attacker to run arbitrary code in the victim’s browser. The impact is non‑disruptive to server operation but can lead to session hijacking, credential theft, or data manipulation by exploiting the victim’s browser context.

The vulnerability affects the Xapian xapian‑core component in any distribution that ships a version older than 2.1.0 or older than 1.4.32. This includes Debian packages and the upstream releases referenced in the advisory links. No other products are listed as affected.

The CVSS score of 4.4 indicates moderate severity. EPSS is not reported, and the flaw is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been observed. The likely attack vector involves a web application that displays search snippets, and an attacker would need to supply a malicious query string that is rendered by the library’s snippet function. The vulnerability requires that the application present the snippet in an HTML context without additional escaping, making exploitation feasible when those conditions are met.