CVE-2025-49579: Starcitizen.tools Citizen XSS Vulnerability

CVE-2025-49579 Overview

CVE-2025-49579 is a stored cross-site scripting (XSS) vulnerability in Citizen, a MediaWiki skin maintained by StarCitizenTools. The flaw lives in the Menu.mustache template, where system messages used as menu headings are rendered as raw HTML. Any user with the editinterface right can inject arbitrary HTML into the Document Object Model (DOM) of every page using the skin. The issue is tracked as [CWE-79] and is fixed in Citizen version 3.3.1.

Critical Impact
Wiki administrators who hold editinterface but not editsitejs can bypass the intended separation of privileges and execute arbitrary script in other users' browsers.

Affected Products

StarCitizenTools Citizen skin for MediaWiki (all versions prior to 3.3.1)
MediaWiki installations where a user group holds editinterface without editsitejs
Wikis exposing the Citizen Menu.mustache template to authenticated editors

Discovery Timeline

2025-06-12 - CVE-2025-49579 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49579

Vulnerability Analysis

The Citizen skin builds its sidebar and menu structures from MediaWiki system messages. In vulnerable releases, menu headings rendered through Menu.mustache were emitted using triple-brace Mustache syntax, which disables HTML escaping. Any content supplied via interface messages flowed directly into the generated markup without sanitization.

MediaWiki's permission model treats editsitejs as the gate for client-side script modifications. By allowing raw HTML through system messages, Citizen effectively granted script execution to any group holding editinterface. This breaks the trust boundary assumed by site administrators who deliberately split the two rights.

Successful exploitation requires an authenticated user with elevated wiki rights and a victim who loads a page containing the poisoned heading. Injected script runs in the context of the wiki origin, enabling session theft, interface defacement, or privilege escalation against users with editsitejs.

Root Cause

The underlying defect is improper neutralization of input during web page generation [CWE-79]. Menu heading values and several related interface messages were concatenated into HTML output without passing through MediaWiki's Html escaping helpers.

Attack Vector

An attacker with the editinterface right edits a MediaWiki namespace message that feeds a Citizen menu heading. When any other user requests a page rendered by the Citizen skin, the injected markup is parsed and executed by the browser.

php

// Patch excerpt: includes/Partials/Drawer.php
public function decorateSidebarData( $sidebarData ) {
-	// Enable label for first portlet
-	$sidebarData['data-portlets-first']['has-label'] = true;
-
	$globalToolsId = $this->getConfigValue( 'CitizenGlobalToolsPortlet' );
	$globalToolsHtml = $this->getGlobalToolsHTML();
	$globalToolsAdded = false;

Source: StarCitizenTools commit 54c8717

A companion commit sanitizes additional system messages and wraps template-literal placeholders in <nowiki> to prevent template expansion:

text

-"citizen-command-palette-tip-templates": "Type <code>{{</code> to search for templates",
+"citizen-command-palette-tip-templates": "Type <code><nowiki>{{</nowiki></code> to search for templates",

Source: StarCitizenTools commit 93c36ac

Detection Methods for CVE-2025-49579

Indicators of Compromise

Edits to MediaWiki interface messages (MediaWiki: namespace) containing <script>, onerror=, onload=, or inline event handlers.
Unexpected <iframe>, <img>, or <svg> tags appearing in rendered sidebar or menu headings.
Browser Content Security Policy (CSP) violation reports originating from pages that render the Citizen skin.

Detection Strategies

Review the MediaWiki logging table for interface edits performed by accounts that lack editsitejs.
Diff current values of Citizen menu-related system messages against the defaults shipped in i18n/en.json.
Scan rendered HTML of representative pages for raw HTML in sidebar headings produced by Menu.mustache.

Monitoring Recommendations

Enable MediaWiki abuse filter rules that flag HTML tags in edits to the MediaWiki: namespace.
Forward web server and MediaWiki audit logs to a centralized analytics platform and alert on anomalous interface edits.
Monitor browser CSP report-uri endpoints for script-src violations tied to wiki domains.

How to Mitigate CVE-2025-49579

Immediate Actions Required

Upgrade the Citizen skin to version 3.3.1 or later on all MediaWiki installations.
Audit user groups and revoke editinterface from accounts that do not require it.
Review recent edits to Citizen-related system messages and revert any that contain HTML or script constructs.

Patch Information

The fix is published in Citizen 3.3.1 through two commits: 54c8717 simplifies the menu header implementation to remove the raw HTML sink, and 93c36ac hardens multiple system messages against stored XSS. Advisory details are documented in GHSA-g3cp-pq72-hjpv.

Workarounds

Remove the editinterface right from non-trusted groups until the upgrade is applied.
Switch wikis temporarily to a different MediaWiki skin that does not render system messages as raw HTML.
Deploy a strict Content Security Policy that blocks inline script execution on wiki pages.

bash

# Upgrade Citizen skin via git to the patched release
cd /var/www/mediawiki/skins/Citizen
git fetch --tags
git checkout v3.3.1
php /var/www/mediawiki/maintenance/update.php --quick