{"id":"CVE-2025-49577","aliases":["EUVD-2025-18207","GHSA-jwr7-992g-68mh"],"status":"published","title":"Citizen allows stored XSS in preference menu headings","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00444,"percentile":0.38897,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-06-12T18:45:18Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"Packagist","package":"starcitizentools/citizen-skin","fixed_in":["3.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"starcitizentools/citizen-skin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"3.3.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"starcitizentools/citizen-skin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"3.3.1"}]}],"versions":["v2.13.0","v2.13.1","v2.13.2","v2.13.3","v2.13.4","v2.13.5","v2.14.0","v2.14.1","v2.15.0","v2.15.1","v2.16.0","v2.16.1","v2.17.0","v2.17.1","v2.17.2","v2.18.0","v2.18.1","v2.19.0","v2.20.0","v2.21.0","v2.22.0","v2.22.1","v2.23.0","v2.24.0","v2.25.0","v2.26.0","v2.27.0","v2.28.0","v2.29.0","v2.30.0","v2.31.0","v2.32.0","v2.33.0","v2.34.0","v2.35.0","v2.36.0","v2.37.0","v2.38.0","v2.38.1","v2.38.2","v2.38.3","v2.39.0","v2.39.1","v2.39.2","v2.39.3","v2.39.4","v2.40.0","v2.40.1","v2.40.2","v3.0.0","v3.1.0","v3.2.0","v3.3.0"]}],"products":[{"vendor":"starcitizen.tools","product":"citizen"},{"vendor":"starcitizentools","product":"mediawiki-skins-citizen"}],"references":[{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-jwr7-992g-68mh","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/a741639085d70c22a9f49890542a142a223bf981","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49577","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jwr7-992g-68mh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49577.json","tags":["advisory"]},{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-49577","title":"Citizen allows stored XSS in preference menu headings","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T18:45:18.415Z","modified":"2025-06-12T19:01:58.426Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:24.825718Z"}],"euvd":[{"id":"EUVD-2025-18207","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T18:45:18Z","modified":"2025-06-12T19:01:58Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:24.065864Z"}],"ghsa":[{"id":"GHSA-jwr7-992g-68mh","title":"starcitizentools/citizen-skin allows stored XSS in preference menu heading messages","description":"### Summary\nVarious preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.\n\n### Details\nThe `innerHtml` of the label div is set to the `textContent` of the label, essentially unsanitizing the system messages:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/407052e7069bdeae927d6f1a2a1c9a45b473bf9a/resources/skins.citizen.preferences/addPortlet.polyfill.js#L18\n\n\n### PoC\n1. Edit `citizen-feature-custom-font-size-name` (or any other message displayed in a heading in the preferences menu) to `\u003cimg src=\"\" onerror=\"alert('citizen-feature-custom-font-size-name')\"\u003e` (script tags don't work here due to the way the HTML is inserted)\n2. Open the preferences menu\n![image](https://github.com/user-attachments/assets/b75f100d-09cc-443c-b635-e9d6ab48d133)","status":"published","published":"2025-06-13T14:08:12Z","modified":"2025-06-13T14:08:13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"nvd":[{"id":"CVE-2025-49577","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T19:15:20.463Z","modified":"2026-06-17T09:31:31.243Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:11.789448Z"}],"osv":[{"id":"CVE-2025-49577","title":"Citizen allows stored XSS in preference menu headings","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T18:45:18.415Z","modified":"2026-10-28T02:31:08.648796472Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-jwr7-992g-68mh","title":"starcitizentools/citizen-skin allows stored XSS in preference menu heading messages","description":"### Summary\nVarious preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.\n\n### Details\nThe `innerHtml` of the label div is set to the `textContent` of the label, essentially unsanitizing the system messages:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/407052e7069bdeae927d6f1a2a1c9a45b473bf9a/resources/skins.citizen.preferences/addPortlet.polyfill.js#L18\n\n\n### PoC\n1. Edit `citizen-feature-custom-font-size-name` (or any other message displayed in a heading in the preferences menu) to `\u003cimg src=\"\" onerror=\"alert('citizen-feature-custom-font-size-name')\"\u003e` (script tags don't work here due to the way the HTML is inserted)\n2. Open the preferences menu\n![image](https://github.com/user-attachments/assets/b75f100d-09cc-443c-b635-e9d6ab48d133)","status":"published","published":"2025-06-13T14:08:12Z","modified":"2025-06-13T14:29:35.649553Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:51.10002Z"}]}}