CVE-2025-49577
Citizen allows stored XSS in preference menu headings
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Citizen allows stored XSS in preference menu headings
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
- Record
CVE-2025-49577- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-18207
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
- Record
EUVD-2025-18207- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jwr7-992g-68mh
starcitizentools/citizen-skin allows stored XSS in preference menu heading messages
Summary
Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.
Details
The innerHtml of the label div is set to the textContent of the label, essentially unsanitizing the system messages:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/407052e7069bdeae927d6f1a2a1c9a45b473bf9a/resources/skins.citizen.preferences/addPortlet.polyfill.js#L18
PoC
- Edit
citizen-feature-custom-font-size-name(or any other message displayed in a heading in the preferences menu) to<img src="" onerror="alert('citizen-feature-custom-font-size-name')">(script tags don't work here due to the way the HTML is inserted) - Open the preferences menu
- Record
GHSA-jwr7-992g-68mh- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
- Record
CVE-2025-49577- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Citizen allows stored XSS in preference menu headings
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
- Record
CVE-2025-49577- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-jwr7-992g-68mh
starcitizentools/citizen-skin allows stored XSS in preference menu heading messages
Summary
Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.
Details
The innerHtml of the label div is set to the textContent of the label, essentially unsanitizing the system messages:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/407052e7069bdeae927d6f1a2a1c9a45b473bf9a/resources/skins.citizen.preferences/addPortlet.polyfill.js#L18
PoC
- Edit
citizen-feature-custom-font-size-name(or any other message displayed in a heading in the preferences menu) to<img src="" onerror="alert('citizen-feature-custom-font-size-name')">(script tags don't work here due to the way the HTML is inserted) - Open the preferences menu
- Record
GHSA-jwr7-992g-68mh- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
starcitizentools/citizen-skinPackagist |
2.13.0 up to 3.3.1 | 3.3.1 |
starcitizentools/citizen-skinPackagist |
2.13.0 up to 3.3.1, plus listed versions v2.13.0v2.13.1v2.13.2v2.13.3v2.13.4 Show 45 moreShow lessv2.13.5v2.14.0v2.14.1v2.15.0v2.15.1v2.16.0v2.16.1v2.17.0v2.17.1v2.17.2v2.18.0v2.18.1v2.19.0v2.20.0v2.21.0v2.22.0v2.22.1v2.23.0v2.24.0v2.25.0v2.26.0v2.27.0v2.28.0v2.29.0v2.30.0v2.31.0v2.32.0v2.33.0v2.34.0v2.35.0v2.36.0v2.37.0v2.38.0v2.38.1v2.38.2v2.38.3v2.39.0v2.39.1v2.39.2v2.39.3v2.39.4v2.40.0v2.40.1v2.40.2v3.0.0 |
3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49577 is a medium vulnerability (CVSS 6.5) in Starcitizen.tools Citizen, published June 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in starcitizentools/citizen-skin 3.3.1.
References
github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-jwr7-992g-68mh
nvd.nist.gov/vuln/detail/CVE-2025-49577
Left out here: 3 versions. The JSON record has them.