6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49578

CVE-2025-49578: starcitizentools/citizen-skin allows stored XSS in user registration date message

Summary

Various date messages returned by Language::userDate are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

Details

The result of $this->lang->userDate( $timestamp, $this->user ) returns unescaped values, but is inserted as raw HTML by Citizen: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/includes/Components/CitizenComponentUserInfo.php#L55-L60

PoC

Go to any page using citizen with the uselang parameter set to x-xss and while being logged in Depending on the registration date of the account you're logged in with, various messages can be shown. In my case, it's november:

Impact

This impacts wikis where a group has the editinterface but not the editsitejs user right.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49578

CVE-2025-49578:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
starcitizentools/citizen-skin	composer	>= 3.3.0, < 3.3.1	3.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-49578 / GHSA-2v3v-3whp-953h) is a stored Cross-Site Scripting (XSS) issue in the starcitizentools/citizen-skin MediaWiki skin. The root cause is the improper handling of user-editable localization messages, specifically date-related messages returned by Language::userDate (a MediaWiki core function). These messages, such as month names, could be manipulated by users with editinterface permissions to include arbitrary HTML and JavaScript.

The primary vulnerable function identified is MediaWiki\Skins\Citizen\Components\CitizenComponentUserInfo::getUserRegistration in includes/Components/CitizenComponentUserInfo.php. This function directly embedded the potentially unescaped output of $this->lang->userDate() into an HTML string using sprintf. An attacker could craft a malicious date message (e.g., a month name containing a script tag) which would then be rendered in the user's browser when their registration date was displayed, leading to XSS. The fix in commit 93c36ac778397e0e7c46cf7adb1e5d848265f1bd addresses this by using Html::element to ensure the date string is properly escaped.

Additionally, the same commit patched another potential XSS vector in the JavaScript function addDefaultPortlet located in resources/skins.citizen.preferences/addPortlet.polyfill.js. This function was changed from using element.innerHTML to element.textContent for assigning content, which is a standard mitigation technique against XSS when the content source might be untrusted or could contain HTML metacharacters.

Other changes in the fix commit, such as modifying Mustache templates (e.g., {{{.}}} to {{.}}) and Vue components (.plain() to .parse()), also contribute to mitigating XSS by ensuring proper escaping and parsing of messages in different contexts within the skin.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.