CVE-2025-53370
Citizen stored XSS vulnerability through short descriptions
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Citizen stored XSS vulnerability through short descriptions
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
- Record
CVE-2025-53370- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-19907
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
- Record
EUVD-2025-19907- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-prmv-7r8c-794g
Citizen vulnerable to Stored XSS through short descriptions
Summary
Short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page.
Details
The shortdesc property, which contains unsanitized user input, is retrieved from the OutputPage and returned as the tagline:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L249-L251
The tagline is then provided to the template data:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L270-L275
The template then inserts the tagline into raw HTML without doing any escaping:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/templates/PageHeading.mustache#L12
PoC
- Enable Citizen and ShortDescription
- Add
{{SHORTDESC:<img src="" onerror="alert('citizen shortdescription xss')">}}to a page - Visit the page
Impact
Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.
- Record
GHSA-prmv-7r8c-794g- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
- Record
CVE-2025-53370- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Citizen stored XSS vulnerability through short descriptions
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
- Record
CVE-2025-53370- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-prmv-7r8c-794g
Citizen vulnerable to Stored XSS through short descriptions
Summary
Short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page.
Details
The shortdesc property, which contains unsanitized user input, is retrieved from the OutputPage and returned as the tagline:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L249-L251
The tagline is then provided to the template data:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L270-L275
The template then inserts the tagline into raw HTML without doing any escaping:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/templates/PageHeading.mustache#L12
PoC
- Enable Citizen and ShortDescription
- Add
{{SHORTDESC:<img src="" onerror="alert('citizen shortdescription xss')">}}to a page - Visit the page
Impact
Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.
- Record
GHSA-prmv-7r8c-794g- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
starcitizentools/citizen-skinPackagist |
1.9.4 up to 3.4.0 | 3.4.0 |
starcitizentools/citizen-skinPackagist |
1.9.4 up to 3.4.0, plus listed versions v1.10.0v1.13.0v1.14.0v1.14.1v1.15.0 Show 45 moreShow lessv1.16.0v1.16.1v1.17.0v1.17.1v1.17.2v1.17.3v1.17.4v1.17.5v1.17.6v1.17.7v1.17.8v1.17.9v1.9.4v1.9.5v2.0.0v2.0.0-alpha.0v2.0.0-alpha.1v2.0.0-alpha.2v2.0.0-beta.0v2.0.0-beta.1v2.0.0-beta.2v2.0.0-beta.3v2.0.0-beta.4v2.0.1v2.1.0v2.10.0v2.10.1v2.11.0v2.11.1v2.12.0v2.13.0v2.13.1v2.13.2v2.13.3v2.13.4v2.13.5v2.14.0v2.14.1v2.15.0v2.15.1v2.16.0v2.16.1v2.17.0v2.17.1v2.17.2 |
3.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-53370 is a high vulnerability (CVSS 8.6) in Starcitizen.tools Citizen, published July 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in starcitizentools/citizen-skin 3.4.0.
References
github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-prmv-7r8c-794g
nvd.nist.gov/vuln/detail/CVE-2025-53370
Left out here: 83 versions. The JSON record has them.