CVE-2025-49575: Starcitizen.tools Citizen XSS Vulnerability

CVE-2025-49575 Overview

CVE-2025-49575 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Citizen MediaWiki skin maintained by StarCitizenTools. Multiple system messages render into the CommandPaletteFooter as raw HTML, allowing any user with the editinterface right to inject arbitrary HTML into the DOM. The flaw affects wikis where a user group holds editinterface without the stricter editsitejs right. The maintainers released a fix in Citizen version 3.3.1.

Critical Impact
Interface editors can store malicious HTML in system messages that executes in the browsers of other wiki users, enabling session theft and account takeover within affected MediaWiki installations.

Affected Products

StarCitizenTools Citizen skin for MediaWiki, all versions prior to 3.3.1
MediaWiki installations exposing the Command Palette feature of the Citizen skin
Wiki configurations granting editinterface without editsitejs

Discovery Timeline

2025-06-12 - CVE-2025-49575 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49575

Vulnerability Analysis

The Citizen skin builds the command palette footer by inserting several MediaWiki system messages into the DOM as raw HTML. Because the messages are not escaped or passed through Html::rawElement with sanitization, any markup present in the message text is interpreted by the browser. An attacker with the editinterface right can edit a MediaWiki: namespace message and embed a <script> tag or an HTML attribute carrying a JavaScript event handler. The injected payload runs in the context of every user who opens the command palette, including administrators.

The weakness falls under improper neutralization of input during web page generation [CWE-79]. In standard MediaWiki deployments, the editsitejs right gates the ability to modify client-side JavaScript. Here, the editinterface right alone grants an equivalent capability because the rendered HTML executes in the user's session.

Root Cause

The root cause is unsafe rendering of translatable message strings. The patched release introduces MediaWiki\Html\Html into CitizenComponentUserInfo.php and reworks the affected tip strings so that literal tokens such as {{ are wrapped in <nowiki> to prevent template parsing from altering the output. The i18n strings for tips including citizen-command-palette-tip-commands, citizen-command-palette-tip-users, citizen-command-palette-tip-namespace, citizen-command-palette-tip-templates, and citizen-command-palette-tip-actions were refactored as part of the fix.

Attack Vector

Exploitation requires authenticated access to an account that holds the editinterface user right. The attacker edits a vulnerable MediaWiki: message page and stores HTML or script content. A victim user triggers the payload by opening the command palette within the Citizen skin interface, satisfying the user-interaction requirement.

text

// Patch excerpt from i18n/en.json (sanitizing a literal token)
-	"citizen-command-palette-tip-templates": "Type <code>{{</code> to search for templates",
+	"citizen-command-palette-tip-templates": "Type <code><nowiki>{{</nowiki></code> to search for templates",

Source: GitHub Commit 93c36ac

php

// Patch excerpt from includes/Components/CitizenComponentUserInfo.php
namespace MediaWiki\Skins\Citizen\Components;

use MediaWiki\Html\Html;
use MediaWiki\Language\Language;
use MediaWiki\MediaWikiServices;
use MediaWiki\Title\MalformedTitleException;

Source: GitHub Commit 93c36ac

Detection Methods for CVE-2025-49575

Indicators of Compromise

Unexpected <script> tags, inline event handlers (onerror, onload), or javascript: URIs stored in MediaWiki: namespace pages that feed the command palette footer.
Recent edits by non-administrative accounts holding editinterface to tip-related system messages such as citizen-command-palette-tip-*.
Outbound requests from authenticated wiki sessions to attacker-controlled domains following command palette usage.

Detection Strategies

Audit the MediaWiki revision log for changes to MediaWiki:Citizen-command-palette-* pages and compare current contents against the strings shipped in Citizen 3.3.1.
Deploy a Content Security Policy (CSP) in report-only mode and investigate violations originating from skin-rendered pages.
Query web proxy or CDN logs for responses containing HTML payloads inside Citizen command palette fragments.

Monitoring Recommendations

Alert on privilege assignments that grant editinterface without a corresponding business justification.
Monitor browser error telemetry and CSP reports for script execution events tied to wiki sessions.
Track installed Citizen skin versions across wikis to confirm all instances have reached 3.3.1 or later.

How to Mitigate CVE-2025-49575

Immediate Actions Required

Upgrade the Citizen skin to version 3.3.1 or later on every MediaWiki installation.
Review all accounts and groups that hold the editinterface right and revoke it where it is not required.
Inspect current contents of MediaWiki:Citizen-command-palette-* pages and revert any unauthorized HTML or script content.

Patch Information

The fix is delivered in two commits in the StarCitizenTools repository: GitHub Commit 4fa69e1 introduces the tip messages, and GitHub Commit 93c36ac resolves the stored XSS by sanitizing the output. See the GitHub Security Advisory GHSA-4c2h-67qq-vm87 for the advisory text.

Workarounds

Temporarily restrict the editinterface right to trusted administrators who already hold editsitejs.
Protect or lock MediaWiki:Citizen-command-palette-* pages so only trusted editors can modify them.
Enforce a strict Content-Security-Policy header that blocks inline scripts and untrusted event handlers while the patch is being rolled out.

bash

# Example LocalSettings.php adjustment to tighten editinterface
$wgGroupPermissions['interface-admin']['editinterface'] = true;
$wgGroupPermissions['sysop']['editinterface'] = false;
$wgGroupPermissions['interface-admin']['editsitejs'] = true;