Medium severity · published Jun 12, 2025
CVE-2025-49576
Citizen allows stored XSS in search no result messages
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
mediawiki-skins-Citizen · StarCitizenTools
>= a0296afaedbe1a277337a2d8f1da83cb3a79b9ab, < 93c36ac778397e0e7c46cf7adb1e5d848265f1bd; >= 2.31.0, < 3.3.1 · source: vendor
CI
Citizen · Starcitizen.tools
before 3.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-49576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-49576
Patch
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd
Patch
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/a0296afaedbe1a277337a2d8f1da83cb3a79b9ab
Exploit
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-86xf-2mgp-gv3g
More from mediawiki-skins-Citizen
6.5
CVE-2025-62508
Citizen vulnerable to stored XSS in sticky header button messages
5.4
CVE-2025-53370
Citizen stored XSS vulnerability through short descriptions
5.4
CVE-2025-53368
Citizen is vulnerable to stored XSS attack in the legacy search bar
5.4
CVE-2025-49578
Citizen allows stored XSS in user registration date message
5.4
CVE-2025-49575
Citizen allows stored XSS in Command Palette tip messages