Description
A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function get_var of the file /contrib/cssgen.php of the component CSS Handler. The manipulation of the argument default-styles/keywords-1/keywords-2/keywords-3/keywords-4/comments leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GeSHi | 1.0.9.0, 1.0.9.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | geshi | 1.0.8.4-2 | — |
| Debian 13 | geshi | 1.0.8.4-2 | — |
| Debian 12 | geshi | 1.0.8.4-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | geshi | No fix yet | — |
| Ubuntu 26.04 LTS | geshi | No fix yet | — |
| Ubuntu 25.10 | geshi | No fix yet | — |
| Ubuntu 24.04 LTS | geshi | No fix yet | — |
| Ubuntu 22.04 LTS | geshi | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | geshi | No fix yet | — |
| Ubuntu 18.04 LTS | geshi | No fix yet | — |
| Ubuntu 16.04 LTS | geshi | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | geshi/geshi | <= 1.0.9.1 | — | GHSA-pr6q-g5gv-qgr7 |
References
- VDB-299036 | GeSHi CSS cssgen.php get_var cross site scripting vdb-entry technical-description
- VDB-299036 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #507418 | GeShi ≤1.0.9.1 Cross Site Scripting third-party-advisory
- https://github.com/GeSHi/geshi-1.0/issues/159 issue-tracking
- https://github.com/GeSHi/geshi-1.0/issues/159#issue-2880408694 exploit issue-tracking