CVE-2025-62508: MediaWiki Citizen Skin XSS Vulnerability

CVE-2025-62508 Overview

CVE-2025-62508 is a stored cross-site scripting (XSS) vulnerability in the Citizen skin for MediaWiki, affecting versions 3.3.0 through 3.8.x. The flaw resides in the sticky header button message handling logic in stickyHeader.js, where the copyButtonAttributes function assigns innerHTML from a source element's textContent. A user with the editinterface right but without editsitejs can inject arbitrary HTML and JavaScript through system interface messages such as citizen-share, citizen-view-history, citizen-view-edit, and nstab-talk. The issue is fixed in Citizen 3.9.0.

Critical Impact
An authenticated attacker with interface-editing privileges can execute arbitrary JavaScript in other users' browser sessions, enabling account takeover of higher-privileged users and unauthorized access to sensitive wiki data.

Affected Products

MediaWiki Citizen skin versions 3.3.0 through 3.8.x
MediaWiki installations where sysop or similar groups hold editinterface without editsitejs
Fixed in Citizen skin version 3.9.0

Discovery Timeline

2025-10-17 - CVE-2025-62508 published to the National Vulnerability Database (NVD)
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-62508

Vulnerability Analysis

The vulnerability is a stored XSS flaw classified under CWE-79. The Citizen skin's sticky header duplicates button labels from existing page elements when the user scrolls. During this copy operation, the client-side code reads the source element's textContent property and writes it into the destination element's innerHTML property.

Because textContent returns the decoded form of previously HTML-escaped content, any entity-encoded markup authored in a MediaWiki system message is converted back into raw HTML when assigned to innerHTML. The browser then parses and executes any <script> tags or event handler attributes contained in that content. The attack requires high privileges (editinterface) but no user interaction beyond normal browsing.

Root Cause

The root cause is the unsafe sink used in the copyButtonAttributes helper inside resources/skins.citizen.scripts/stickyHeader.js. The function trusts that interface-message content is safe to render as HTML, but MediaWiki's rendering pipeline only guarantees safety when values are inserted via textContent or server-side escaping. The mismatch between source encoding and destination sink converts safe stored content into executable script.

Attack Vector

An attacker in a group with the editinterface right edits a system message (for example MediaWiki:Citizen-share) and inserts HTML-encoded markup such as <img src=x onerror=alert(1)>. When any user loads a page that renders the sticky header, the payload executes in that user's session context. This allows the attacker to steal session cookies, perform CSRF-protected actions on behalf of the victim, or escalate privileges by targeting bureaucrats and stewards.

javascript

// Patch diff from stickyHeader.js (commit e006923)
copyAttribute( from, to, 'title' );
// Copy button labels
if ( to.lastElementChild && from.lastElementChild ) {
-    to.lastElementChild.innerHTML = from.lastElementChild.textContent || '';
+    to.lastElementChild.textContent = from.lastElementChild.textContent || '';
}

Source: GitHub Commit e006923. The fix replaces the innerHTML sink with textContent, ensuring the copied label is always treated as literal text.

Detection Methods for CVE-2025-62508

Indicators of Compromise

Edits to system messages MediaWiki:Citizen-share, MediaWiki:Citizen-view-history, MediaWiki:Citizen-view-edit, or MediaWiki:Nstab-talk containing HTML entities, <script> tags, or on*= event handler attributes
Unexpected outbound requests from browser sessions of privileged users to attacker-controlled domains shortly after loading wiki pages
Creation or modification of sysop, bureaucrat, or interface-admin accounts without matching legitimate audit entries

Detection Strategies

Query the MediaWiki logging table for type='protect' and action='edit' events targeting pages in the MediaWiki: namespace, then inspect diff content for HTML-encoded script payloads
Deploy a Content Security Policy (CSP) in report-only mode and monitor violation reports for inline script executions originating from sticky header DOM nodes
Hash the deployed stickyHeader.js and alert on any skin version with the vulnerable innerHTML assignment pattern

Monitoring Recommendations

Enable MediaWiki AbuseFilter rules that flag edits to MediaWiki: namespace pages containing < or < sequences
Centralize MediaWiki access and audit logs in a SIEM and correlate interface-message edits with subsequent privilege changes
Review the membership of groups holding the editinterface right on a scheduled basis and remove inactive accounts

How to Mitigate CVE-2025-62508

Immediate Actions Required

Upgrade the Citizen skin to version 3.9.0 or later on all MediaWiki installations
Audit all pages in the MediaWiki: namespace, particularly Citizen-share, Citizen-view-history, Citizen-view-edit, and Nstab-talk, and revert any content containing encoded HTML or script constructs
Rotate session tokens and force re-authentication for all users holding the editinterface right

Patch Information

The vulnerability is remediated in Citizen skin 3.9.0. The fix is implemented across two commits: GitHub Commit e006923 replaces the unsafe innerHTML assignment with textContent in stickyHeader.js, and GitHub Commit fbb1d4f re-implements the sticky header using server-side CitizenComponentStickyHeader and CitizenComponentButton PHP components. Full advisory details are available in GitHub Security Advisory GHSA-g955-vw6w-v6pp.

Workarounds

Temporarily disable the Citizen skin or switch default skin assignment to Vector until the upgrade is applied
Revoke the editinterface right from the sysop group and grant it only to a smaller, trusted interface-admin group
Deploy a strict Content Security Policy that disallows inline scripts and event handlers to limit the impact of successful injection

bash

# Update Citizen skin via git to the patched release
cd /var/www/mediawiki/skins/Citizen
git fetch --tags
git checkout v3.9.0
php /var/www/mediawiki/maintenance/update.php --quick