6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49579

CVE-2025-49579: starcitizentools/citizen-skin allows stored XSS in menu heading message

Summary

All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

Details

The system messages for menu headings are inserted unescaped into raw HTML: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/templates/Menu.mustache#L8-L10

PoC

Go to any article using citizen with the uselang parameter set to x-xss
A large number of alerts will be shown for various messages, e.g.:

On the main page of my test wiki, the following messages were shown: navigation, notifications, user-interface-preferences, personaltools, variants, views, associated-pages, cactions and toolbox.

Impact

This impacts wikis where a group has the editinterface but not the editsitejs user right.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49579

CVE-2025-49579:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
starcitizentools/citizen-skin	composer	>= 2.4.2, < 3.3.1	3.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The core vulnerability (GHSA-g3cp-pq72-hjpv, CVE-2025-49579) lies in the unescaped rendering of system messages within menu headings generated by the Menu.mustache template. Users with editinterface permissions could modify these system messages (e.g., MediaWiki:Navigation, MediaWiki:Notifications) to include malicious HTML and JavaScript. When the Citizen skin rendered these messages as menu labels using {{{.}}} (or an effectively unescaped {{label}} in earlier versions), the malicious code would execute in the context of other users' browsers, leading to a stored XSS.

The security patch 93c36ac778397e0e7c46cf7adb1e5d848265f1bd addresses this primary issue by changing the template to use {{.}} for labels, ensuring proper HTML escaping.

Furthermore, this commit also fixed several other XSS vulnerabilities throughout the Citizen skin:

In CitizenComponentUserInfo::getUserRegistration, by switching from manual HTML construction with sprintf to the safer Html::element for user registration dates.
In CommandPaletteFooter.vue, by changing how mw.message outputs are handled (from .plain() to .parse(), implying that the messages might contain intended HTML/wikitext that now gets processed by MediaWiki's safer parser) and by fixing underlying i18n message content.
In the addDefaultPortlet JavaScript function, by replacing a risky innerHTML assignment with a safer textContent assignment.
In the TypeaheadPlaceholder.mustache template, by ensuring title and description variables are rendered with escaping.

Collectively, these changes indicate a broader pattern of insufficient output escaping for dynamic or user-controllable data in various parts of the skin, which were rectified in the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.