CVE-2025-2123: GeSHi CSS Handler XSS Vulnerability in get_var Function
Summary
CVE-2025-2123: GeSHi XSS possible in the get_var function of /contrib/cssgen.php. Affects geshi/geshi versions < 1.0.9.1. No fix is published. How to fix ↓
Also tracked for
- geshi · Debian:11
The same CVE-2025-2123 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeSHi, short for Generic Syntax Highlighter, is a widely used open-source library that provides syntax highlighting for various programming languages. It is commonly utilized in web applications to enhance code readability. The library includes a CSS Handler component that manages styles for the highlighted code. However, versions up to 1.0.9.1 of GeSHi are vulnerable to a cross-site scripting (XSS) attack due to improper handling of user input in the get_var function within the cssgen.php file.
Vulnerability Detail
The vulnerability arises from the manipulation of specific arguments passed to the get_var function, which can lead to cross-site scripting (XSS) attacks. An attacker can exploit this vulnerability by crafting a malicious request that includes harmful scripts in the default-styles or keywords parameters. If successful, this could allow the attacker to execute arbitrary scripts in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious activities. The vulnerability has been classified as moderate in severity, with a CVSS score of 3.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize the input parameters before passing them to the get_var function to prevent XSS attacks. For example, you can use PHP's htmlspecialchars function to encode special characters: $safe_input =
htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
Conclusion
In summary, CVE-2025-2123 is a moderate severity vulnerability in the GeSHi library that allows for XSS attacks through improper handling of input in the get_var function. Users are advised to update to a patched version to mitigate the risk and ensure the security of their applications.
See every vulnerability recorded for geshi/geshi →
FAQ
The impact includes potential XSS attacks, which can lead to data theft and unauthorized actions performed in the context of the user's session.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of GeSHi up to 1.0.9.1 are affected by this vulnerability.
Yes, a patched version of GeSHi is available. Users should update to the latest version beyond 1.0.9.1.
XSS, or cross-site scripting, is a vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. It can lead to data theft, session hijacking, and other malicious activities.
Related vulnerabilities
Recent vulnerabilities recorded for geshi/geshi.
