CVE-2026-58030: XSS Vulnerability in Wikimedia SyntaxHighlight_GeSHi Extension

Technical summary

CVE-2026-58030 is a Stored or Reflected XSS vulnerability (CWE-79) in the SyntaxHighlight_GeSHi MediaWiki extension. The vulnerability is located in includes/SyntaxHighlight.php and results from the failure to properly neutralize special characters or HTML entities when processing code block syntax highlighting input. The affected versions span multiple release branches: all versions prior to 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are vulnerable. The vulnerability requires no authentication and can be exploited over the network, but does require user interaction (UI:R) to trigger, such as viewing a page containing the malicious payload. The impact is limited to confidentiality and integrity breaches (C:L/I:L) with no availability impact, and the scope is changed (S:C), meaning the vulnerable component can affect resources beyond its security scope.

Business impact

For organizations operating MediaWiki instances—including internal knowledge bases, documentation systems, and public wikis—this vulnerability poses a reputational and operational risk. Successful exploitation could compromise user sessions, allowing attackers to impersonate editors, modify pages, or harvest credentials. If the wiki is public-facing or contains sensitive information, attackers could deface content, inject malware links, or launch secondary attacks against readers. The need for user interaction (clicking a link or viewing a page) lowers the immediate risk compared to unauthenticated worms, but within an organization where users frequently click internal wiki links, the risk is elevated. Regulatory or compliance frameworks may be affected if user data or audit trails are compromised.

Affected systems

The SyntaxHighlight_GeSHi extension affects all MediaWiki installations using vulnerable versions. Specifically, any deployment running: SyntaxHighlight_GeSHi prior to version 1.46.0 (latest stable), 1.45.4 (1.45.x branch), 1.44.6 (1.44.x branch), or 1.43.9 (1.43.x branch) is at risk. This extension is commonly installed on both self-hosted and cloud-based MediaWiki instances, including enterprise documentation systems, open-source project wikis, and educational platforms. Administrators should verify which version of SyntaxHighlight_GeSHi is deployed and against which version of MediaWiki core it is running, as extension version support may vary by MediaWiki release.

Exploitability

Exploitation requires network access and user interaction, which limits the attack surface compared to unauthenticated remote code execution flaws. However, within a trust-based internal wiki environment or a public wiki with active users, the bar for triggering the vulnerability is low—an attacker simply needs to create or edit a wiki page containing a malicious code block or craft a deceptive link. No special privileges are required; any user with editing rights can inject the payload. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects that while the attack is feasible, it does require a victim to visit a page or click a link. Public-facing wikis or internal systems with many editors present higher risk than minimally-used or read-only wikis. Currently, this vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation is not yet widespread, but this should not be interpreted as a reason to delay patching.

Remediation

Upgrade SyntaxHighlight_GeSHi to the patched versions immediately: version 1.46.0 or later for the latest stable branch, 1.45.4 for the 1.45.x series, 1.44.6 for the 1.44.x series, or 1.43.9 for the 1.43.x series. Before upgrading, back up your wiki database and extensions directory. Test the upgrade in a staging environment first to ensure compatibility with your MediaWiki core version and any custom configurations or dependent extensions. After patching, clear any cached content and verify that syntax highlighting continues to function correctly. If immediate patching is not possible, consider disabling the SyntaxHighlight_GeSHi extension temporarily or restricting edit permissions to trusted users until the patch can be deployed.

Patch guidance

Patching should be prioritized based on your wiki's exposure: public-facing wikis with many users or editors should patch within 48–72 hours, while internal-only wikis with restricted editor access may have a slightly longer window but should still patch within one week. The Wikimedia Foundation provides patches through its official extension repository. Download the appropriate version from the SyntaxHighlight_GeSHi release page, extract it over the existing installation (or replace the entire extension directory), and restart your web server if necessary. Verify the patch by checking the extension version in Special:Version on your wiki. Document the patch date and version for compliance and audit records.

Detection guidance

Detect exploitation by monitoring wiki revision logs for suspicious code blocks with HTML or JavaScript payloads, particularly those added by users with atypical editing patterns. Search wiki history for common XSS patterns such as <script>, javascript:, onerror=, onclick=, or data: URIs within code blocks. Web application firewalls (WAFs) should be configured to block requests containing XSS payloads in page content. Monitor web server logs for unusual User-Agent strings, rapid requests from the same IP, or 400-level responses that might indicate blocked payloads. Enable wiki auditing and review recent page edits for defacement or malicious content injection. Browser console errors in users' JavaScript or reports of unexpected behavior may indicate successful exploitation.

Why prioritize this

This vulnerability merits prompt attention due to the combination of no authentication requirement, network accessibility, and potential impact on data integrity and user trust. While the CVSS score of 6.1 (Medium) reflects the user-interaction requirement, the attack vector is simple and does not require specialized knowledge. The vulnerability affects a widely-deployed component (syntax highlighting) on wikis used for critical documentation and collaboration. The absence from the KEV catalog currently does not diminish the priority, as attackers may not yet have public tools or the wiki may be an attractive target due to its data sensitivity. Patched versions are available and straightforward to deploy, making remediation efficient.

Risk score, explained

The CVSS 3.1 score of 6.1 (Medium) reflects a vulnerability that is network-accessible without authentication or elevated privileges (AV:N/AC:L/PR:N), but requires user interaction to trigger (UI:R). The scope change (S:C) indicates that a successful attack can affect resources beyond the vulnerable component itself, such as other users' sessions or the wiki's overall integrity. The impact is limited to confidentiality and integrity loss (C:L/I:L) with no availability impact (A:N), consistent with an XSS attack that steals data or modifies content rather than crashing the service. The score appropriately reflects a genuine but not critical risk—not every user will encounter the malicious payload, and the payload requires crafting and placement by an attacker or compromised editor. Organizations with high-value or sensitive wiki content, or with large numbers of users, should weight their local risk higher than the base CVSS score suggests.

Frequently asked questions