GHSA-jwr7-992g-68mh

Suggest an improvement
Source
https://github.com/advisories/GHSA-jwr7-992g-68mh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-jwr7-992g-68mh/GHSA-jwr7-992g-68mh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jwr7-992g-68mh
Aliases
Published
2025-06-13T14:08:12Z
Modified
2025-06-13T14:29:35Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
starcitizentools/citizen-skin allows stored XSS in preference menu heading messages
Details

Summary

Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

Details

The innerHtml of the label div is set to the textContent of the label, essentially unsanitizing the system messages: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/407052e7069bdeae927d6f1a2a1c9a45b473bf9a/resources/skins.citizen.preferences/addPortlet.polyfill.js#L18

PoC

  1. Edit citizen-feature-custom-font-size-name (or any other message displayed in a heading in the preferences menu) to <img src="" onerror="alert('citizen-feature-custom-font-size-name')"> (script tags don't work here due to the way the HTML is inserted)
  2. Open the preferences menu image
Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-13T14:08:12Z",
    "nvd_published_at": "2025-06-12T19:15:20Z",
    "severity": "MODERATE"
}
References

Affected packages

Packagist / starcitizentools/citizen-skin

Package

Name
starcitizentools/citizen-skin
Purl
pkg:composer/starcitizentools/citizen-skin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.13.0
Fixed
3.3.1

Affected versions

v2.*
v2.13.0
v2.13.1
v2.13.2
v2.13.3
v2.13.4
v2.13.5
v2.14.0
v2.14.1
v2.15.0
v2.15.1
v2.16.0
v2.16.1
v2.17.0
v2.17.1
v2.17.2
v2.18.0
v2.18.1
v2.19.0
v2.20.0
v2.21.0
v2.22.0
v2.22.1
v2.23.0
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v2.29.0
v2.30.0
v2.31.0
v2.32.0
v2.33.0
v2.34.0
v2.35.0
v2.36.0
v2.37.0
v2.38.0
v2.38.1
v2.38.2
v2.38.3
v2.39.0
v2.39.1
v2.39.2
v2.39.3
v2.39.4
v2.40.0
v2.40.1
v2.40.2
v3.*
v3.0.0
v3.1.0
v3.2.0
v3.3.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-jwr7-992g-68mh/GHSA-jwr7-992g-68mh.json"