8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53370

CVE-2025-53370: Citizen vulnerable to Stored XSS through short descriptions

Summary

Short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page.

Details

The shortdesc property, which contains unsanitized user input, is retrieved from the OutputPage and returned as the tagline: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L249-L251 The tagline is then provided to the template data: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/includes/Components/CitizenComponentPageHeading.php#L270-L275 The template then inserts the tagline into raw HTML without doing any escaping: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/0d8a44011e02a081618359a1e90f462478e807aa/templates/PageHeading.mustache#L12

PoC

Enable Citizen and ShortDescription
Add {{SHORTDESC:<img src="" onerror="alert('citizen shortdescription xss')">}} to a page
Visit the page

Impact

Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53370

CVE-2025-53370:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
starcitizentools/citizen-skin	composer	>= 1.9.4, < 3.4.0	3.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability analysis focused on the provided commit patches, which directly address the security issue. The commit c85a40bddc8651fff66df83a72debddcb34f0521 is explicitly linked to the CVE in question and shows a clear change in the getTagline function within the CitizenComponentPageHeading.php file. The code change from $tagline = $shortdesc; to $tagline = htmlspecialchars( $shortdesc, ENT_QUOTES ); is the core of the fix. It demonstrates that the getTagline function was the point where the unsanitized, user-controlled input ($shortdesc) was being processed and passed along for rendering. Therefore, this function is identified as the vulnerable function. During exploitation, a call to this function would be present in the runtime profile as it prepares the data for the page's tagline. The other commit, aedbceb3380bb48db6b59e272fc187529c71c8ca, addresses a similar XSS issue in the search functionality (and references a different CVE), but the primary vulnerability described is in the page heading, making CitizenComponentPageHeading::getTagline the key vulnerable function for CVE-2025-53370.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.