GHSA-prmv-7r8c-794g
Suggest an improvement- Source
- https://github.com/advisories/GHSA-prmv-7r8c-794g
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-prmv-7r8c-794g/GHSA-prmv-7r8c-794g.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-prmv-7r8c-794g
- Aliases
- Published
- 2025-07-03T21:29:16Z
- Modified
- 2025-07-03T22:27:20.020611Z
- Severity
-
- 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
- Summary
- Citizen vulnerable to Stored XSS through short descriptions
- Details
-
Summary
Short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page.
Details
The
shortdescproperty, which contains unsanitized user input, is retrieved from the OutputPage and returned as the tagline: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L249-L251 The tagline is then provided to the template data: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L270-L275 The template then inserts the tagline into raw HTML without doing any escaping: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/templates/PageHeading.mustache#L12PoC
- Enable Citizen and ShortDescription
- Add
{{SHORTDESC:<img src="" onerror="alert('citizen shortdescription xss')">}}to a page - Visit the page
Impact
Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.
- Database specific
{ "severity": "HIGH", "github_reviewed_at": "2025-07-03T21:29:16Z", "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "nvd_published_at": "2025-07-03T20:15:23Z" }- References
-
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-prmv-7r8c-794g
- https://nvd.nist.gov/vuln/detail/CVE-2025-53370
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/aedbceb3380bb48db6b59e272fc187529c71c8ca
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/c85a40bddc8651fff66df83a72debddcb34f0521
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases/tag/v3.4.0
Affected packages
Packagist / starcitizentools/citizen-skin
Package
- Name
- starcitizentools/citizen-skin
- Purl
- pkg:composer/starcitizentools/citizen-skin