Vulnerability · Published Jun 12, 2025 · Assigned by GitHub_M
CVE-2025-49577Citizen allows stored XSS in preference menu headings
Medium 6.5
In plain English
A medium-severity cross-site scripting in mediawiki-skins-Citizen from StarCitizenTools. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 63.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | starcitizentools/citizen-skin | 3.3.1 | GHSA-jwr7-992g-68mh |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| StarCitizenTools | mediawiki-skins-Citizen | >= a741639085d70c22a9f49890542a142a223bf981, < 93c36ac778397e0e7c46cf7adb1e5d848265f1bd>= 2.13.0, < 3.3.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-jwr7-992g-68mh x_refsource_CONFIRM
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd x_refsource_MISC
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/a741639085d70c22a9f49890542a142a223bf981 x_refsource_MISC