Citizen skin vulnerable to stored XSS through multiple system messages

中 5.4CVE-2025-49575 · GHSA-4c2h-67qq-vm87 · 12/06/2025 公開 · 17/06/2026 更新

要点

CVE-2025-49575 は starcitizentools/citizen-skin, citizen (starcitizen.tools) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.43%（全脆弱性の 37.0% より高い）。
対処：3.3.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
starcitizentools/citizen-skin Packagist	`≥ 2.4.2, < 3.3.1`	`3.3.1`
citizen starcitizen.tools	`< 3.3.1`	`3.3.1`

概要

Summary

Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

Details

The messages are retrieved using the plain() output mode: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L61-L66 currentTip is set to one of these messages: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L69 currentTip is inserted as raw HTML (vue/no-v-html should not be ignored here): https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L3-L4

PoC

Edit citizen-command-palette-tip-commands, citizen-command-palette-tip-users, citizen-command-palette-tip-namespace and citizen-command-palette-tip-templates to <img src="" onerror="alert(1)"> (script tags don't work here due to the way the HTML is inserted)
Open the command palette

Impact

This impacts wikis where a group has the editinterface but not the editsitejs user right.

NVD の説明

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.