{"id":"CVE-2025-49578","aliases":["EUVD-2025-18205","GHSA-2v3v-3whp-953h"],"status":"published","title":"Citizen allows stored XSS in user registration date message","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00444,"percentile":0.38944,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-06-12T18:50:49Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"Packagist","package":"starcitizentools/citizen-skin","fixed_in":["3.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"starcitizentools/citizen-skin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"starcitizentools/citizen-skin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.3.1"}]}],"versions":["v3.3.0"]}],"products":[{"vendor":"starcitizen.tools","product":"citizen"},{"vendor":"starcitizentools","product":"mediawiki-skins-citizen"}],"references":[{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-2v3v-3whp-953h","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/64cb5d7ab3a6dc0381fae54b31e8fc4afadc8beb","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49578","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2v3v-3whp-953h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49578.json","tags":["advisory"]},{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-49578","title":"Citizen allows stored XSS in user registration date message","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T18:50:49.3Z","modified":"2025-06-12T19:12:17.575Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:24.825718Z"}],"euvd":[{"id":"EUVD-2025-18205","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T18:50:49Z","modified":"2025-06-12T19:12:17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:24.065864Z"}],"ghsa":[{"id":"GHSA-2v3v-3whp-953h","title":"starcitizentools/citizen-skin allows stored XSS in user registration date message","description":"### Summary\nVarious date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.\n\n### Details\nThe result of `$this-\u003elang-\u003euserDate( $timestamp, $this-\u003euser )` returns unescaped values, but is inserted as raw HTML by Citizen:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/includes/Components/CitizenComponentUserInfo.php#L55-L60\n\n### PoC\n1. Go to any page using citizen with the uselang parameter set to x-xss and while being logged in\nDepending on the registration date of the account you're logged in with, various messages can be shown. In my case, it's `november`:\n![image](https://github.com/user-attachments/assets/252a3453-99c8-4ce1-b6d6-a8485b7a9a43)\n\n\n### Impact\nThis impacts wikis where a group has the `editinterface` but not the `editsitejs` user right.","status":"published","published":"2025-06-13T14:09:00Z","modified":"2025-06-13T14:09:02Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"nvd":[{"id":"CVE-2025-49578","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T19:15:20.61Z","modified":"2026-06-17T09:31:31.357Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:11.789448Z"}],"osv":[{"id":"CVE-2025-49578","title":"Citizen allows stored XSS in user registration date message","description":"Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.","status":"published","published":"2025-06-12T18:50:49.3Z","modified":"2026-10-28T02:31:04.978457119Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-2v3v-3whp-953h","title":"starcitizentools/citizen-skin allows stored XSS in user registration date message","description":"### Summary\nVarious date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.\n\n### Details\nThe result of `$this-\u003elang-\u003euserDate( $timestamp, $this-\u003euser )` returns unescaped values, but is inserted as raw HTML by Citizen:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/includes/Components/CitizenComponentUserInfo.php#L55-L60\n\n### PoC\n1. Go to any page using citizen with the uselang parameter set to x-xss and while being logged in\nDepending on the registration date of the account you're logged in with, various messages can be shown. In my case, it's `november`:\n![image](https://github.com/user-attachments/assets/252a3453-99c8-4ce1-b6d6-a8485b7a9a43)\n\n\n### Impact\nThis impacts wikis where a group has the `editinterface` but not the `editsitejs` user right.","status":"published","published":"2025-06-13T14:09:00Z","modified":"2025-06-13T14:29:35.716971Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}