8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53369

CVE-2025-53369: Citizen Short Description stored XSS vulnerability through wikitext

Summary

Short descriptions are not properly sanitized by the ShortDescription before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page.

Details

The description provided by the user via the {{SHORTDESC:}} parser function is insufficiently sanitized by the sanitize() function, as html entities are decoded: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/includes/Hooks/ParserHooks.php#L147-L159 Via JS, the short description is then passed to mw.util.addSubtitle, which inserts it as raw HTML: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/modules/ext.shortDescription.js#L8 https://github.com/wikimedia/mediawiki/blob/96372101b3c579d9992e8a31a3ccd90a937cac47/resources/src/mediawiki.util/util.js#L552-L563

PoC

Enable ShortDescription
Make sure $wgShortDescriptionEnableTagline is set to true (this is the default)
Create a page and insert the following wikitext: {{SHORTDESC:<img src="" onerror="alert('shortdescription xss')">}}
Visit the page

Impact

Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53369

CVE-2025-53369:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
starcitizentools/short-description	composer	>= 4.0.0, < 4.0.1	4.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the mediawiki-extensions-ShortDescription extension. The root cause is twofold: insufficient sanitization of user-provided short descriptions on the server-side, and the lack of output escaping on the client-side.

The provided patch addresses the client-side vulnerability. The main function in modules/ext.shortDescription.js was identified as the vulnerable function. This function retrieves the short description and injects it into the page's subtitle. Before the patch, it used mw.util.addSubtitle(shortdesc) which renders raw HTML, allowing any malicious script saved in the short description to be executed. The fix, mw.util.addSubtitle(mw.html.escape(shortdesc)), ensures that the short description is treated as plain text, neutralizing the XSS threat.

While the vulnerability description also points to a weak sanitize() function in includes/Hooks/ParserHooks.php on the server, the provided patch only modifies the client-side JavaScript. The immediate vulnerable function that would appear in a runtime profile during exploitation is the JavaScript main function, as it's directly responsible for injecting the malicious payload into the DOM.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.