Citizen vulnerable to stored XSS in sticky header button messages
Summary
The JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages.
Details
In the copyButtonAttributes function in stickyHeader.js, when copying the button labels, the innerHTML of the new element is set to the textContent of the old element:
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/f4cbcecf5aca0ae69966b23d4983f9cb5033f319/resources/skins.citizen.scripts/stickyHeader.js#L29-L41
This unescapes any escaped HTML characters and causes the contents of the system messages to be interpreted as HTML.
PoC
- Edit any of the affected messages (
citizen-share,citizen-view-history,citizen-view-edit,nstab-talk) to the following payload:<img src="" onerror="alert('Sticky Header Button XSS')">. - Visit any mainpage article in the wiki using the Citizen skin.
Impact
This impacts wikis where a group has the editinterface but not the editsitejs user right. By default, this is the case for the sysop group.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | starcitizentools/citizen-skin | >= 3.3.0, < 3.9.0 | 3.9.0 |
References
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g955-vw6w-v6pp
- https://nvd.nist.gov/vuln/detail/CVE-2025-62508
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/e006923c6dbf113c9a025ca186ecc09fe7b93a15
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/fbb1d4fe9627281567706f3f6fc99a42ce16fdc4
- https://github.com/StarCitizenTools/mediawiki-skins-Citizen
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
starcitizentools/citizen-skin- Disclosed
- 20.10.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-g955-vw6w-v6pp - CC BY 4.0
Vulnerability history: starcitizentools/citizen-skin
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 9
- First → latest
- 09.2024 10.2025
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 7
Disclosures per year
- 2024: 1
- 2025: 8
- 2026: 0
-
Citizen vulnerable to stored XSS in sticky header button messages this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.