Cross-Site Scripting Vulnerability in GeSHi Package
Summary
DEBIAN-CVE-2025-2123: A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affects geshi versions < 1.0.8.4-2. Fixed in 1.0.8.4-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeSHi (Generic Syntax Highlighter) is a popular library used for syntax highlighting in various programming languages. It is widely utilized in web applications to enhance code readability by applying color coding to different syntax elements. The library is designed to support multiple languages and offers customization options for styling. However, a vulnerability has been identified in versions up to 1.0.9.1 that exposes users to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
A vulnerability classified as problematic has been discovered in GeSHi versions up to 1.0.9.1. The issue resides in the function get_var located in the file /contrib/cssgen.php, specifically within the CSS Handler component. The vulnerability arises from improper handling of user input in the arguments default-styles/keywords-1/keywords-2/keywords-3/keywords-4/comments, which can lead to cross-site scripting (XSS) attacks. This allows attackers to inject malicious scripts that could be executed in the context of the user's browser, potentially compromising user data and session integrity. The exploit has been publicly disclosed, making it imperative for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
1.0.8.4-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade geshiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can sanitize and validate any input passed to the affected function to prevent the execution of malicious scripts. Implementing input validation can help mitigate the risk of XSS attacks until the package is updated.
Conclusion
The identified cross-site scripting vulnerability in the GeSHi package poses a significant risk to web applications using this library. Users are strongly advised to update to the patched version 1.0.8.4-2 or later to safeguard against potential attacks. Implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for geshi →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to inject malicious scripts into web applications.
Versions of GeSHi up to 1.0.9.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, implement input validation and sanitization as a temporary workaround to mitigate the risk of XSS attacks.
More information about GeSHi can be found on its official website and documentation, which provide details about its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for geshi.
