CVE-2025-53368: Citizen MediaWiki Skin XSS Vulnerability

CVE-2025-53368 Overview

CVE-2025-53368 is a stored cross-site scripting (XSS) vulnerability in the Citizen skin for MediaWiki, maintained by StarCitizenTools. The flaw affects versions 1.9.4 through versions before 3.4.0. The old search bar inserts page descriptions into raw HTML without sanitization, allowing users with page editing privileges to plant XSS payloads that execute in the browsers of other users searching for those pages. The maintainers released a fix in version 3.4.0.

Critical Impact
Authenticated editors can inject persistent JavaScript into search typeahead results, hijacking sessions or performing actions on behalf of any wiki user who triggers the search.

Affected Products

StarCitizenTools Citizen skin for MediaWiki versions 1.9.4 and later
StarCitizenTools Citizen skin for MediaWiki versions before 3.4.0
MediaWiki installations using the Citizen skin with the old search module enabled

Discovery Timeline

2025-07-03 - CVE-2025-53368 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53368

Vulnerability Analysis

The vulnerability is a stored cross-site scripting (XSS) flaw classified under [CWE-79]. The Citizen skin renders search typeahead results using a Mustache template that emits the page description with triple-brace syntax. Triple braces in Mustache disable HTML escaping. Any HTML or JavaScript embedded in a page description is inserted directly into the DOM when another user searches for that page.

Exploitation requires an authenticated account with page editing privileges. The payload persists in the page description and executes for every user whose search typeahead lists the affected page. The attack targets a different security scope, making the impact broader than the attacker's own session.

Root Cause

The root cause resides in resources/skins.citizen.search/templates/TypeaheadListItem.mustache. The template used {{{.}}} for the description field, which renders raw HTML. Correct handling requires {{.}}, which HTML-escapes the value before insertion into the typeahead list item.

Attack Vector

An attacker with editing privileges creates or edits a page and crafts a description containing an XSS payload. When any user types a query that surfaces the poisoned page in the old search bar typeahead, the browser parses the malicious markup and executes the injected script in the victim's session context.

text

 		<div class="citizen-typeahead-list-item-text">
 			{{#text}}{{.}}{{/text}}
 			{{#title}}<div class="citizen-typeahead-list-item-title">{{{.}}}</div>{{/title}}
-			{{#description}}<div class="citizen-typeahead-list-item-description">{{{.}}}</div>{{/description}}
+			{{#description}}<div class="citizen-typeahead-list-item-description">{{.}}</div>{{/description}}
 		</div>
 		{{#html-end}}<div class="citizen-typeahead-list-item-end">{{{.}}}</div>{{/html-end}}
 	</a>

Source: GitHub commit aedbceb — the patch replaces the unescaped {{{.}}} interpolation with the escaping {{.}} variant for the description field.

Detection Methods for CVE-2025-53368

Indicators of Compromise

Page descriptions containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or event handler attributes
MediaWiki revision history showing description edits that add angle brackets, javascript: URIs, or encoded payload strings
Browser console errors or unexpected outbound requests when using the Citizen skin's old search typeahead
Reports of unauthorized session activity from users who interacted with the search bar

Detection Strategies

Query the MediaWiki database for page descriptions containing HTML metacharacters or script-related keywords.
Review the revision log for accounts editing many page descriptions in a short window, which may indicate payload seeding.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from the typeahead DOM.

Monitoring Recommendations

Monitor MediaWiki RecentChanges and API edit endpoints for anomalous description field content.
Alert on CSP violation reports referencing the citizen-typeahead-list-item-description element or inline event handlers.
Track outbound requests from wiki users' browsers to unknown domains that could indicate cookie or token exfiltration.

How to Mitigate CVE-2025-53368

Immediate Actions Required

Upgrade the Citizen skin to version 3.4.0 or later on all MediaWiki installations.
Audit existing page descriptions for HTML or script content and sanitize or revert malicious entries.
Rotate session tokens for privileged accounts if a payload was confirmed to have executed.
Restrict page editing privileges to trusted users while remediation is in progress.

Patch Information

StarCitizenTools released the fix in Citizen v3.4.0. The corrective change is documented in GitHub commit aedbceb and the coordinated advisory GHSA-rq6g-6g94-jfr4. The patch changes the Mustache template to HTML-escape the description field.

Workarounds

Disable the old search module and use the newer search implementation until the upgrade is applied.
Enforce a strict Content Security Policy that blocks inline scripts and unauthorized event handlers.
Temporarily remove edit permissions from untrusted user groups on wikis that cannot be patched immediately.

bash

# Update the Citizen skin to the patched release
cd /path/to/mediawiki/skins/Citizen
git fetch --tags
git checkout v3.4.0
php /path/to/mediawiki/maintenance/update.php