CVE-2025-49579
Citizen allows stored XSS in menu heading message
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the editinterface but not the editsitejs user right. This vulnerability is fixed in 3.3.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Citizen allows stored XSS in menu heading message
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the editinterface but not the editsitejs user right. This vulnerability is fixed in 3.3.1.
- Record
CVE-2025-49579- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-18204
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the editinterface but not the editsitejs user right. This vulnerability is fixed in 3.3.1.
- Record
EUVD-2025-18204- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g3cp-pq72-hjpv
starcitizentools/citizen-skin allows stored XSS in menu heading message
Summary
All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.
Details
The system messages for menu headings are inserted unescaped into raw HTML: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/templates/Menu.mustache#L8-L10
PoC
- Go to any article using citizen with the
uselangparameter set tox-xss - A large number of alerts will be shown for various messages, e.g.:
On the main page of my test wiki, the following messages were shown: navigation, notifications, user-interface-preferences, personaltools, variants, views, associated-pages, cactions and toolbox.
Impact
This impacts wikis where a group has the editinterface but not the editsitejs user right.
- Record
GHSA-g3cp-pq72-hjpv- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the editinterface but not the editsitejs user right. This vulnerability is fixed in 3.3.1.
- Record
CVE-2025-49579- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Citizen allows stored XSS in menu heading message
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the editinterface but not the editsitejs user right. This vulnerability is fixed in 3.3.1.
- Record
CVE-2025-49579- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-g3cp-pq72-hjpv
starcitizentools/citizen-skin allows stored XSS in menu heading message
Summary
All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.
Details
The system messages for menu headings are inserted unescaped into raw HTML: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/templates/Menu.mustache#L8-L10
PoC
- Go to any article using citizen with the
uselangparameter set tox-xss - A large number of alerts will be shown for various messages, e.g.:
On the main page of my test wiki, the following messages were shown: navigation, notifications, user-interface-preferences, personaltools, variants, views, associated-pages, cactions and toolbox.
Impact
This impacts wikis where a group has the editinterface but not the editsitejs user right.
- Record
GHSA-g3cp-pq72-hjpv- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
starcitizentools/citizen-skinPackagist |
2.4.2 up to 3.3.1 | 3.3.1 |
starcitizentools/citizen-skinPackagist |
2.4.2 up to 3.3.1, plus listed versions v2.10.0v2.10.1v2.11.0v2.11.1v2.12.0 Show 45 moreShow lessv2.13.0v2.13.1v2.13.2v2.13.3v2.13.4v2.13.5v2.14.0v2.14.1v2.15.0v2.15.1v2.16.0v2.16.1v2.17.0v2.17.1v2.17.2v2.18.0v2.18.1v2.19.0v2.20.0v2.21.0v2.22.0v2.22.1v2.23.0v2.24.0v2.25.0v2.26.0v2.27.0v2.28.0v2.29.0v2.30.0v2.31.0v2.32.0v2.33.0v2.34.0v2.35.0v2.36.0v2.37.0v2.38.0v2.38.1v2.38.2v2.38.3v2.39.0v2.39.1v2.39.2v2.39.3 |
3.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49579 is a medium vulnerability (CVSS 6.5) in Starcitizen.tools Citizen, published June 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in starcitizentools/citizen-skin 3.3.1.
References
github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g3cp-pq72-hjpv
nvd.nist.gov/vuln/detail/CVE-2025-49579
Left out here: 41 versions. The JSON record has them.