6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49577

CVE-2025-49577: starcitizentools/citizen-skin allows stored XSS in preference menu heading messages

Summary

Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

Details

The innerHtml of the label div is set to the textContent of the label, essentially unsanitizing the system messages: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/407052e7069bdeae927d6f1a2a1c9a45b473bf9a/resources/skins.citizen.preferences/addPortlet.polyfill.js#L18

PoC

Edit citizen-feature-custom-font-size-name (or any other message displayed in a heading in the preferences menu) to <img src="" onerror="alert('citizen-feature-custom-font-size-name')"> (script tags don't work here due to the way the HTML is inserted)
Open the preferences menu

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49577

CVE-2025-49577:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
starcitizentools/citizen-skin	composer	>= 2.13.0, < 3.3.1	3.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the addDefaultPortlet function within the resources/skins.citizen.preferences/addPortlet.polyfill.js file. The description clearly states that innerHTML is used with textContent, leading to an XSS vulnerability.

Commit a741639085d70c22a9f49890542a142a223bf981 introduced the vulnerable file addPortlet.polyfill.js and the addDefaultPortlet function containing the line labelDiv.innerHTML = label.textContent || '';. This line is problematic because label.textContent can originate from system messages (like citizen-feature-custom-font-size-name mentioned in the PoC) which, if editable by an attacker, can contain malicious HTML. Assigning this directly to innerHTML causes the browser to parse and render this HTML, leading to XSS.

Commit 93c36ac778397e0e7c46cf7adb1e5d848265f1bd fixes this vulnerability by changing the problematic line to labelDiv.textContent = label.textContent || '';. Using textContent for assignment ensures that the string is treated as plain text and not parsed as HTML, thus mitigating the XSS risk.

The function addDefaultPortlet is directly responsible for creating and inserting the DOM element (labelDiv) where the malicious HTML can be injected. Therefore, it is the vulnerable function that would appear in a runtime profile during the exploitation of this XSS vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-49577: starcitizentools/citizen-skin allows stored XSS in preference menu heading messages

Summary

Details

PoC

CVE-2025-49577:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

6.5

6.5

Basic Information

Basic Information

CVE-2025-49577: starcitizentools/citizen-skin allows stored XSS in preference menu heading messages

Summary

Details

PoC

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI