{"id":"CVE-2025-62508","aliases":["GHSA-g955-vw6w-v6pp"],"url":"https://o3.security/vulnerability/CVE-2025-62508","summary":"Citizen vulnerable to stored XSS in sticky header button messages","details":"### Summary\nThe JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages.\n\n### Details\nIn the `copyButtonAttributes` function in `stickyHeader.js`, when copying the button labels, the `innerHTML` of the new element is set to the `textContent` of the old element:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/f4cbcecf5aca0ae69966b23d4983f9cb5033f319/resources/skins.citizen.scripts/stickyHeader.js#L29-L41\nThis unescapes any escaped HTML characters and causes the contents of the system messages to be interpreted as HTML.\n\n### PoC\n1. Edit any of the affected messages (`citizen-share`, `citizen-view-history`, `citizen-view-edit`, `nstab-talk`) to the following payload: `<img src=\"\" onerror=\"alert('Sticky Header Button XSS')\">`.\n2. Visit any mainpage article in the wiki using the Citizen skin.\n\n<img width=\"495\" height=\"228\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ac75b8e1-b181-4335-9526-17d6b6f8518e\" />\n<img width=\"569\" height=\"157\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c052edb9-ff68-4869-9c66-3ec85e7ff68a\" />\n\n\n### Impact\nThis impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. By default, this is the case for the `sysop` group.","published":"2025-10-17T20:29:47.235Z","modified":"2026-08-12T03:51:23.000736822Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"starcitizentools/citizen-skin","fixedVersion":"3.9.0"}],"fix":{"url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/e006923c6dbf113c9a025ca186ecc09fe7b93a15","label":"StarCitizenTools/mediawiki-skins-Citizen@e006923"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62508.json"},{"type":"ADVISORY","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g955-vw6w-v6pp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62508"},{"type":"FIX","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/e006923c6dbf113c9a025ca186ecc09fe7b93a15"},{"type":"FIX","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/fbb1d4fe9627281567706f3f6fc99a42ce16fdc4"},{"type":"PACKAGE","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:23.000736822Z"}}