PT-2025-42653 · Mediawiki · Citizen

Published 2025-10-17 · Updated 2025-10-21 · CVE-2025-62508

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Citizen versions 3.3.0 through 3.9.0

Description Citizen, a MediaWiki skin, has an issue where stored cross-site scripting can occur in the sticky header button message handling. The copyButtonAttributes function in stickyHeader.js assigns innerHTML from a source element’s textContent when copying button labels. This allows escaped HTML in system message content (such as citizen-share, citizen-view-history, citizen-view-edit, and nstab-talk) to be interpreted as HTML in the sticky header, potentially enabling the injection of arbitrary script. A user with the editinterface right, but without the editsitejs right, can execute arbitrary JavaScript in other users’ sessions, potentially gaining unauthorized access to sensitive data or performing unauthorized actions.

Recommendations Update to version 3.9.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62508

GHSA-G955-VW6W-V6PP

Affected Products

Citizen

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62508.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62508 · Security Note
• https://osv.dev/vulnerability/GHSA-g955-vw6w-v6pp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62508 · Vendor Advisory
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen · Note
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/fbb1d4fe9627281567706f3f6fc99a42ce16fdc4 · Note
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/e006923c6dbf113c9a025ca186ecc09fe7b93a15 · Note
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g955-vw6w-v6pp · Note
• https://t.me/cveNotify/139269 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ocdw3y/resumen_diario_de_vulnerabilidades_21102025 · Reddit Post
• https://twitter.com/CVEnew/status/1979289010670350624 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1979374035709419981 · Twitter Post
• https://t.me/CVEtracker/35222 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ocduv6/resumen_diario_de_vulnerabilidades_21102025 · Reddit Post