TI-2025-31591 Aliases CVE-2025-49578 GHSA-2v3v-3whp-953h

Citizen allows stored XSS in user registration date message

MEDIUM 62CWE-79Published 2025-06-12 · Updated 2025-06-12

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00426 37th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed mediawiki-skins-Citizen (StarCitizenTools): 93c36ac778397e0e7c46cf7adb1e5d848265f1bd, 3.3.1starcitizentools/citizen-skin (Packagist): 3.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
StarCitizenTools	mediawiki-skins-Citizen	64cb5d7ab3a6dc0381fae54b31e8fc4afadc8beb to before 93c36ac778397e0e7c46cf7adb1e5d848265f1bd; 3.3.0 to before 3.3.1	93c36ac778397e0e7c46cf7adb1e5d848265f1bd, 3.3.1	Patch available	CNA
—	starcitizentools/citizen-skin (Packagist)	3.3.0 to before 3.3.1	3.3.1	Patch available	GHSA-2v3v-3whp-953h

mediawiki-skins-Citizen VendorStarCitizenTools Affected 64cb5d7ab3a6dc0381fae54b31e8fc4afadc8beb to before 93c36ac778397e0e7c46cf7adb1e5d848265f1bd; 3.3.0 to before 3.3.1 Fixed in 93c36ac778397e0e7c46cf7adb1e5d848265f1bd, 3.3.1 Patch available CNA
starcitizentools/citizen-skin (Packagist) Vendor— Affected 3.3.0 to before 3.3.1 Fixed in 3.3.1 Patch available GHSA-2v3v-3whp-953h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:starcitizen.tools:citizen::::::mediawiki::*	before 3.3.1	Vulnerable	StarCitizenTools

cpe:2.3:a:starcitizen.tools:citizen:*:*:*:*:*:mediawiki:*:* Versions before 3.3.1 Vulnerable ·StarCitizenTools

Remediation

Fix · CNA mediawiki-skins-Citizen (StarCitizenTools) Fixed in 93c36ac778397e0e7c46cf7adb1e5d848265f1bd, 3.3.1
Fix · GHSA-2v3v-3whp-953h starcitizentools/citizen-skin (Packagist) Fixed in 3.3.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-49578
2026-10-03 Alias added: GHSA-2v3v-3whp-953h

References

Exploit 1

https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-2v3v-3whp-953h

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-49578

Other 1

https://github.com/StarCitizenTools/mediawiki-skins-Citizen

TI-2025-33330 Citizen is vulnerable to stored XSS attack in the legacy search bar CVSS 3.1HIGH 8.6
TI-2025-33332 Citizen stored XSS vulnerability through short descriptions CVSS 3.1HIGH 8.6
TI-2024-23953 Citizen has a Stored Cross-Site Scripting Vulnerability by editing MediaWiki:Tagline CVSS 3.1MEDIUM 6.5
TI-2025-31592 Citizen allows stored XSS in menu heading message CVSS 3.1MEDIUM 6.5
TI-2025-31590 Citizen allows stored XSS in preference menu headings CVSS 3.1MEDIUM 6.5
TI-2025-31589 Citizen allows stored XSS in search no result messages CVSS 3.1MEDIUM 6.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences