CVE-2025-49577: Starcitizen.tools Citizen XSS Vulnerability

CVE-2025-49577 Overview

CVE-2025-49577 is a stored cross-site scripting (XSS) vulnerability in Citizen, a MediaWiki skin developed by StarCitizenTools. The flaw affects Citizen versions prior to 3.3.1. Various preference-related system messages are inserted directly into raw HTML without proper escaping. Any user with permission to edit MediaWiki system messages, typically administrators or interface editors, can inject arbitrary HTML and JavaScript into the DOM. When other users visit affected pages, the injected script executes in their browser session, enabling session theft, forced actions, or defacement. The vulnerability is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Users with system-message editing rights can persist arbitrary HTML into wiki pages served by the Citizen skin, executing script in the context of every visiting user.

Affected Products

StarCitizenTools Citizen skin for MediaWiki, all versions prior to 3.3.1
MediaWiki installations that have deployed the Citizen skin
Wikis exposing preferences UI rendered by the vulnerable Citizen components

Discovery Timeline

2025-06-12 - CVE-2025-49577 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49577

Vulnerability Analysis

The vulnerability is a stored XSS issue in the Citizen skin's preferences and command palette messages. Citizen renders several i18n message keys, including preference labels and command palette tips, directly into raw HTML. The MediaWiki message system permits privileged users to modify these messages through the MediaWiki: namespace. Because the values are inserted without HTML escaping, an attacker with edit rights on system messages can embed <script> tags or event-handler attributes that persist across sessions. The payload executes whenever the preferences interface or command palette renders for any user.

Exploitation requires network access, low privileges (a system-message editor account), and user interaction to visit an affected page. The vulnerability affects confidentiality and integrity of user sessions and can pivot to other wiki users, including administrators.

Root Cause

Citizen concatenated translated messages into HTML fragments without wrapping user-controllable message text in Html:: escaping helpers. Message keys such as prefs-citizen-theme-label and citizen-command-palette-tip-templates contained inline <code> markup, encouraging maintainers to treat them as HTML-safe. Any operator with rights to edit these messages could inject unescaped HTML, satisfying the stored XSS pattern documented in CWE-79.

Attack Vector

An attacker with interface-admin or equivalent rights edits a system message such as MediaWiki:Prefs-citizen-theme-label and inserts an HTML payload. The Citizen skin subsequently emits that message as raw HTML in the preferences UI or command palette. A victim opens Special:Preferences or triggers the command palette and the injected script runs in the victim's browser under the wiki's origin.

php

// Patch excerpt from includes/Components/CitizenComponentUserInfo.php
// Source: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd

namespace MediaWiki\Skins\Citizen\Components;

use MediaWiki\Html\Html;
use MediaWiki\Language\Language;
use MediaWiki\MediaWikiServices;
use MediaWiki\Title\MalformedTitleException;

The patch introduces MediaWiki\Html\Html so that message values are routed through proper escaping helpers rather than raw HTML concatenation. A companion i18n change wraps template syntax in <nowiki> to prevent unintended parsing:

text

// Patch excerpt from i18n/en.json
// Source: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd

-"citizen-command-palette-tip-templates": "Type <code>{{</code> to search for templates",
+"citizen-command-palette-tip-templates": "Type <code><nowiki>{{</nowiki></code> to search for templates",

Detection Methods for CVE-2025-49577

Indicators of Compromise

Recent edits to MediaWiki: namespace pages matching Citizen preference or command palette message keys such as MediaWiki:Prefs-citizen-theme-label or MediaWiki:Citizen-command-palette-tip-templates
System message content containing <script>, on*= event handlers, javascript: URIs, or unexpected <iframe> tags
Outbound requests from user browsers to unfamiliar domains after loading Special:Preferences on wikis using Citizen

Detection Strategies

Audit the MediaWiki logging table for movepage and edit actions on Citizen-related message keys within the vulnerable window
Compare live message content against the canonical i18n/en.json values shipped in Citizen 3.3.1 to identify tampered strings
Deploy Content Security Policy reporting on the wiki origin to surface inline script execution originating from preferences pages

Monitoring Recommendations

Alert on any edit to pages under MediaWiki:Prefs-citizen-*, MediaWiki:Citizen-command-palette-*, or MediaWiki:Skin-theme-*
Monitor privileged role assignments granting editinterface or editsitejs on wikis deploying Citizen
Review web server logs for anomalous requests originating from sessions immediately after preferences page loads

How to Mitigate CVE-2025-49577

Immediate Actions Required

Upgrade the Citizen skin to version 3.3.1 or later on every MediaWiki instance where it is installed
Review the MediaWiki: namespace for any Citizen preference or command palette message that contains HTML beyond the <code> and <nowiki> tags shipped in the fixed release
Rotate session cookies and force reauthentication for administrators who accessed affected pages before patching

Patch Information

The vendor released the fix in Citizen 3.3.1. The remediation is delivered through two commits: commit 93c36ac escapes message values through the MediaWiki\Html\Html helper and adjusts i18n strings, and commit a7416390 moves theme preferences to clientPrefs, removing the vulnerable prefs-citizen-theme-* message surface. Refer to the GitHub Security Advisory GHSA-jwr7-992g-68mh for advisory details.

Workarounds

Restrict editinterface rights to a minimal, trusted set of administrators until the upgrade is applied
Temporarily switch affected wikis to a different skin such as Vector until Citizen 3.3.1 is deployed
Enforce a strict Content Security Policy that disallows inline scripts to blunt the impact of any injected payload

bash

# Verify installed Citizen skin version and upgrade
cd /var/www/mediawiki/skins/Citizen
git fetch --tags
git checkout v3.3.1
php /var/www/mediawiki/maintenance/update.php --quick