Vulnerability details

CVE-2025-53368

StarCitizenTools mediawiki-skins-Citizen

Citizen is vulnerable to stored XSS attack in the legacy search bar

CVSS 3.1

8.6High

Official description

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.

CVSS scores

Score	Version	Source	Vector
8.6High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L`

Affected products

Vendor	Product	Versions	Source
StarCitizenTools	mediawiki-skins-Citizen	>= 1.9.4, < 3.4.0	CVEProject cvelistV5 (CNA)
StarCitizenTools	mediawiki-skins-Citizen	>= b2bd79196db1153d0bc1bd51a646d957cbdf4aec, < aedbceb3380bb48db6b59e272fc187529c71c8ca	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-rq6g-6g94-jfr4 x_refsource_CONFIRM
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/aedbceb3380bb48db6b59e272fc187529c71c8ca x_refsource_MISC
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases/tag/v3.4.0 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-07-03
Last updated: 2025-07-03
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.35%

Probability of exploitation in 30 days

28.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')