{"id":"CVE-2025-53370","aliases":["GHSA-prmv-7r8c-794g"],"url":"https://o3.security/vulnerability/CVE-2025-53370","summary":"Citizen stored XSS vulnerability through short descriptions","details":"### Summary\nShort descriptions set via the [ShortDescription extension](https://www.mediawiki.org/wiki/Extension:ShortDescription) are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page.\n\n### Details\nThe `shortdesc` property, which contains unsanitized user input, is retrieved from the OutputPage and returned as the tagline:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L249-L251\nThe tagline is then provided to the template data:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L270-L275\nThe template then inserts the tagline into raw HTML without doing any escaping:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/templates/PageHeading.mustache#L12\n\n### PoC\n1. Enable Citizen and ShortDescription\n2. Add `{{SHORTDESC:<img src=\"\" onerror=\"alert('citizen shortdescription xss')\">}}` to a page\n3. Visit the page\n![image](https://github.com/user-attachments/assets/d45f3626-c5eb-4477-86af-d15d3a1edb96)\n![image](https://github.com/user-attachments/assets/84a8c447-d441-4bd6-b6d6-48e504527c4e)\n\n\n### Impact\nArbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.","published":"2025-07-03T19:45:32.163Z","modified":"2026-08-12T03:51:49.087945030Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"},"epss":{"score":0.00318,"percentile":0.23973,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"starcitizentools/citizen-skin","fixedVersion":"3.4.0"}],"fix":{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/c85a40bddc8651fff66df83a72debddcb34f0521","label":"StarCitizenTools/mediawiki-skins-Citizen@c85a40b"},"references":[{"type":"WEB","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases/tag/v3.4.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53370.json"},{"type":"ADVISORY","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-prmv-7r8c-794g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53370"},{"type":"FIX","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/c85a40bddc8651fff66df83a72debddcb34f0521"},{"type":"WEB","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/aedbceb3380bb48db6b59e272fc187529c71c8ca"},{"type":"PACKAGE","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:49.087945030Z"}}