CVE-2008-5185: Geshi

Medium severity, CVSS 5.0. EPSS: 3.9% chance of exploitation in the next 30 days.

The highlighting functionality in geshi.php in GeSHi before 1.0.8 allows remote attackers to cause a denial of service (infinite loop) via an XML sequence containing an opening delimiter without a closing delimiter, as demonstrated using "<".

Affected products

• Geshi Geshi: up to and including 1.0.7.22; version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.2_beta_1 only; version 1.0.3 only; …

Published 2008-11-21. Last modified 2026-06-16.