Cross-site Scripting Vulnerability in SyntaxHighlight_GeSHi by Wikimedia Foundation
CVE-2026-58030

5.3MEDIUM

Key Information:

Vendor

Wikimedia Foundation

Status
Syntaxhighlight Geshi
Vendor
CVE Published:
1 July 2026

What is CVE-2026-58030?

A Cross-site Scripting (XSS) vulnerability exists in the SyntaxHighlight_GeSHi component of the Wikimedia Foundation. This flaw is caused by improper neutralization of user input during web page generation, which may allow attackers to execute arbitrary scripts in the context of users' browsers. The affected versions include SyntaxHighlight_GeSHi prior to 1.46.0, specifically 1.45.4, 1.44.6, and 1.43.9. Attackers could exploit this vulnerability to perform unwanted actions on behalf of users, potentially compromising their privacy and security.

Affected Version(s)

SyntaxHighlight_GeSHi * < 1.46.0, 1.45.4, 1.44.6, 1.43.9

References

https://phabricator.wikimedia.org/T427167

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.