[CVE-2018-0499] Incomplete HTML escaping by Xapian::MSet::snippet()
Vulnerable versions: xapian-core 1.4.5 and earlier (back to when this feature was added in development release 1.3.5; 1.2.x doesn't have this method, so isn't vulnerable).
Fixed in xapian-core 1.4.6
2026-08-13 update
The original fix missed the case where hi_start and hi_end are both empty strings and text.size() <= length.
This is fixed in 2.1.0 and 1.4.32, but if you want to apply just this fix to an older release (the actual fix is the same in all these patches, but the context lines have varied over time):
- Patch for 2.0.0
- Patch for 1.4.16 to 1.4.31 inclusive
- Patch for 1.4.6 to 1.4.15 inclusive
- Patch for 1.4.5 and earlier (includes the original fixes from 2018)
- xapian-discuss announcement
We suspect empty highlighting strings are an unusual way to use this method, and haven't managed to find any real world example of such use, but the fix is small and unlikely to cause problems so we recommend applying it, or auditing your code to check it doesn't call MSet::snippet() in this way.
