-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| starcitizentools/citizen-skin | composer | >= 2.4.2, < 3.3.1 | 3.3.1 |
Miggo AIRoot Cause AnalysisThe vulnerability (GHSA-4c2h-67qq-vm87 / CVE-2025-49575) encompasses multiple stored Cross-Site Scripting (XSS) flaws within the StarCitizenTools/mediawiki-skins-Citizen skin. The fundamental cause across these issues is the improper handling and sanitization of data, particularly system messages or other content that can be influenced by users with editinterface permissions, before it is rendered as HTML in the user's browser.
The primary vulnerability, as highlighted in the advisory, resides in the CommandPaletteFooter.vue component. System messages intended as tips were fetched using mw.message(...).plain(). This method does not escape HTML entities within the message content. Subsequently, these potentially unsafe messages were rendered into the DOM using Vue's v-html directive, which explicitly allows raw HTML rendering, thereby creating an XSS vector.
The security patch (commit 93c36ac778397e0e7c46cf7adb1e5d848265f1bd) addressed this specific issue by changing .plain() to .parse(), which is designed to handle wikitext and produce safe HTML output suitable for rendering.
Beyond this main issue, the same commit also rectified several other XSS vulnerabilities:
includes/Components/CitizenComponentUserInfo.php, the getUserRegistration method was modified to use Html::element for constructing HTML instead of sprintf with potentially unescaped date strings.resources/skins.citizen.preferences/addPortlet.polyfill.js, an assignment to innerHTML was replaced with an assignment to textContent to prevent potential HTML injection through portlet labels.templates/Menu.mustache and resources/skins.citizen.search/templates/TypeaheadPlaceholder.mustache), triple-stashes ({{{.}}}), which render unescaped HTML, were replaced with double-stashes ({{.}}) to ensure data is properly escaped before rendering.These fixes collectively mitigate the risk of attackers injecting malicious scripts by controlling the content of various system messages or other data points within the wiki interface.