starcitizentools/mediawiki-skins-citizen · Security
starcitizentools/citizen-skin allows stored XSS in preference menu heading messages
- GHSA ID
- GHSA-jwr7-992g-68mh
- CVE ID
- CVE-2025-49577
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Description
Summary
Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.
Details
The innerHtml of the label div is set to the textContent of the label, essentially unsanitizing the system messages:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/407052e7069bdeae927d6f1a2a1c9a45b473bf9a/resources/skins.citizen.preferences/addPortlet.polyfill.js#L18
PoC
- Edit
citizen-feature-custom-font-size-name(or any other message displayed in a heading in the preferences menu) to<img src="" onerror="alert('citizen-feature-custom-font-size-name')">(script tags don't work here due to the way the HTML is inserted) - Open the preferences menu
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-jwr7-992g-68mh ↗
- https://nvd.nist.gov/vuln/detail/CVE-2025-49577 ↗
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd ↗
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/a741639085d70c22a9f49890542a142a223bf981 ↗
- https://github.com/advisories/GHSA-jwr7-992g-68mh ↗