Cross-Site Scripting Vulnerability in GeSHi Package
Summary
CVE-2025-2123: A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affects geshi across 2 version ranges.
< 1.0.8.4-2
< fd22ab78481bf90337862b590e6f7517863926b8
Fixed in 1.0.8.4-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GeSHi (Generic Syntax Highlighter) is a popular library used for syntax highlighting in various programming languages. It is widely utilized in web applications to enhance code readability and presentation. The library supports a multitude of languages and provides customizable options for styling. However, versions up to 1.0.9.1 have been found to contain a critical vulnerability that exposes applications to cross-site scripting (XSS) attacks, potentially compromising user data and application integrity.
Vulnerability Detail
A vulnerability classified as problematic has been identified in GeSHi versions up to 1.0.9.1. The issue arises from the function get_var in the file /contrib/cssgen.php within the CSS Handler component. Specifically, the manipulation of the argument default-styles/keywords-1/keywords-2/keywords-3/keywords-4/comments can lead to cross-site scripting (XSS). This vulnerability allows attackers to execute arbitrary scripts in the context of the user’s browser, which can result in data theft, session hijacking, or other malicious activities. The attack can be launched remotely, making it particularly dangerous. The exploit has been publicly disclosed and is actively being used.
How To Fix
Minimum fixed version
1.0.8.4-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade geshiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation and sanitization on the affected parameters to prevent XSS attacks. This can be done by encoding user inputs and ensuring that any dynamic content is properly escaped before rendering in the browser.
Conclusion
The identified cross-site scripting vulnerability in the GeSHi package poses significant risks to web applications utilizing this library. It is crucial for developers and system administrators to update to a patched version promptly and consider implementing additional security measures to protect against potential exploits.
See every vulnerability recorded for geshi →
FAQ
The CVSS score of this vulnerability is 3.5, indicating a moderate level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
The consequences include unauthorized script execution, data theft, session hijacking, and potential damage to user trust and application integrity.
Yes, ensure that you are using a version of GeSHi that is higher than 1.0.9.1 to avoid this vulnerability.
Implement input validation and sanitization on the affected parameters as a temporary measure to mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for geshi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
