geoip_language allows for arbitrary redirects, so is a security hazard.

If you have the module enabled and go to http://mysite.com/index.php?q=http://google.com you will immediately be redirected to google. (you can swap google for any full url.)

Code causing the issue:

// Now that the language is detected, do an absolute redirect to avoid page
  // caching in the wrong language.
  $url = url($_GET['q'], array('language' => $language, 'absolute' => TRUE, 'external' => FALSE, 'query' => drupal_query_string_encode($_GET, array('q'))));
  drupal_goto($url, NULL, NULL, 301);

I hardcoded the external option to false. The problem was that url was auto-detecting the q parameter as an external website, and creating the url accordingly. That was being passed to drupal_goto() and causing the arbitrary redirect,