{"id":"CVE-2025-49575","aliases":["EUVD-2025-18208","GHSA-4c2h-67qq-vm87"],"status":"published","title":"Citizen allows stored XSS in Command Palette tip messages","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00444,"percentile":0.38898,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-06-11T19:59:54Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"Packagist","package":"starcitizentools/citizen-skin","fixed_in":["3.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"starcitizentools/citizen-skin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2"},{"fixed":"3.3.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"starcitizentools/citizen-skin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2"},{"fixed":"3.3.1"}]}],"versions":["v2.10.0","v2.10.1","v2.11.0","v2.11.1","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.13.3","v2.13.4","v2.13.5","v2.14.0","v2.14.1","v2.15.0","v2.15.1","v2.16.0","v2.16.1","v2.17.0","v2.17.1","v2.17.2","v2.18.0","v2.18.1","v2.19.0","v2.20.0","v2.21.0","v2.22.0","v2.22.1","v2.23.0","v2.24.0","v2.25.0","v2.26.0","v2.27.0","v2.28.0","v2.29.0","v2.30.0","v2.31.0","v2.32.0","v2.33.0","v2.34.0","v2.35.0","v2.36.0","v2.37.0","v2.38.0","v2.38.1","v2.38.2","v2.38.3","v2.39.0","v2.39.1","v2.39.2","v2.39.3","v2.39.4","v2.4.2","v2.4.3","v2.4.4","v2.40.0","v2.40.1","v2.40.2","v2.5.0","v2.5.1","v2.5.2","v2.6.0","v2.6.1","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.6.6","v2.7.0","v2.7.1","v2.7.10","v2.7.11","v2.7.2","v2.7.3","v2.7.4","v2.7.5","v2.7.6","v2.7.7","v2.7.8","v2.7.9","v2.8.0","v2.8.1","v2.8.2","v2.8.3","v2.8.4","v2.8.5","v2.9.0","v2.9.1","v3.0.0","v3.1.0","v3.2.0","v3.3.0"]}],"products":[{"vendor":"starcitizen.tools","product":"citizen"},{"vendor":"starcitizentools","product":"mediawiki-skins-citizen"}],"references":[{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-4c2h-67qq-vm87","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/4fa69e1d062dca7e407cc0530cf1da3e2baaf0b5","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/54c8717d45ce1594918f11cb9ce5d0ccd8dfee65","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49575","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4c2h-67qq-vm87"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49575.json","tags":["advisory"]},{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-49575","title":"Citizen allows stored XSS in Command Palette tip messages","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T18:45:23.363Z","modified":"2025-06-12T18:58:25.445Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:24.825718Z"}],"euvd":[{"id":"EUVD-2025-18208","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T18:45:23Z","modified":"2025-06-12T18:58:25Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:24.065864Z"}],"ghsa":[{"id":"GHSA-4c2h-67qq-vm87","title":"Citizen skin vulnerable to stored XSS through multiple system messages","description":"### Summary\nMultiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.\n\n### Details\nThe messages are retrieved using the `plain()` output mode: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L61-L66\n`currentTip` is set to one of these messages: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L69\n`currentTip` is inserted as raw HTML (`vue/no-v-html` should *not* be ignored here): https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L3-L4\n\n### PoC\n1. Edit `citizen-command-palette-tip-commands`, `citizen-command-palette-tip-users`, `citizen-command-palette-tip-namespace` and `citizen-command-palette-tip-templates` to `\u003cimg src=\"\" onerror=\"alert(1)\"\u003e` (script tags don't work here due to the way the HTML is inserted)\n2. Open the command palette\n![image](https://github.com/user-attachments/assets/f07b238b-1ac1-4781-8d03-db755ba04546)\n\n### Impact\nThis impacts wikis where a group has the `editinterface` but not the `editsitejs` user right.","status":"published","published":"2025-06-11T19:59:54Z","modified":"2025-06-13T03:44:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"nvd":[{"id":"CVE-2025-49575","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T19:15:20.16Z","modified":"2026-06-17T09:31:31.027Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:11.789448Z"}],"osv":[{"id":"CVE-2025-49575","title":"Citizen allows stored XSS in Command Palette tip messages","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T18:45:23.363Z","modified":"2026-10-28T02:30:46.022696307Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-4c2h-67qq-vm87","title":"Citizen skin vulnerable to stored XSS through multiple system messages","description":"### Summary\nMultiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.\n\n### Details\nThe messages are retrieved using the `plain()` output mode: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L61-L66\n`currentTip` is set to one of these messages: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L69\n`currentTip` is inserted as raw HTML (`vue/no-v-html` should *not* be ignored here): https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L3-L4\n\n### PoC\n1. Edit `citizen-command-palette-tip-commands`, `citizen-command-palette-tip-users`, `citizen-command-palette-tip-namespace` and `citizen-command-palette-tip-templates` to `\u003cimg src=\"\" onerror=\"alert(1)\"\u003e` (script tags don't work here due to the way the HTML is inserted)\n2. Open the command palette\n![image](https://github.com/user-attachments/assets/f07b238b-1ac1-4781-8d03-db755ba04546)\n\n### Impact\nThis impacts wikis where a group has the `editinterface` but not the `editsitejs` user right.","status":"published","published":"2025-06-11T19:59:54Z","modified":"2025-06-13T04:30:31.802497Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}