CVE-2025-53368: starcitizentools/citizen-skin Stored XSS Vulnerability in Legacy Search Bar
Summary
CVE-2025-53368: Page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Affects starcitizentools/citizen-skin versions >= 1.9.4, < 3.4.0. Fixed in 3.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The starcitizentools/citizen-skin package is a MediaWiki skin designed for the Star Citizen community, providing a unique interface and features tailored for users. It allows for customization and enhances the user experience on MediaWiki-powered wikis. However, it is vulnerable to a Stored XSS attack due to improper sanitization of page descriptions when using the legacy search bar, which can lead to malicious scripts being executed in the browsers of users searching for specific pages.
Vulnerability Detail
The vulnerability arises from the Citizen skin's handling of page descriptions, which are inserted into raw HTML without proper sanitization. This flaw allows attackers to inject malicious scripts into the DOM, affecting users who search for specific pages. The impact is significant as it can lead to unauthorized actions being performed in the context of the user's session, potentially compromising user data and security.
How To Fix
Minimum fixed version
3.4.0
This is the first release that contains the fix.
composer require starcitizentools/citizen-skin:3.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, disable the command palette by setting $wgCitizenEnableCommandPalette = false; in your LocalSettings.php. Additionally, use the action API as the Search Gateway by adding $wgCitizenSearchGateway = 'mwActionApi'; to your configuration.
Conclusion
The starcitizentools/citizen-skin package is vulnerable to a Stored XSS attack due to improper handling of page descriptions in the legacy search bar. It is crucial to update to the patched version to mitigate risks associated with this vulnerability. Temporary workarounds are available, but updating is the recommended approach for long-term security.
See every vulnerability recorded for starcitizentools/citizen-skin →
FAQ
Stored XSS (Cross-Site Scripting) is a type of security vulnerability where an attacker can inject malicious scripts into web pages that are then served to other users.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring sign-up.
The potential impacts include unauthorized actions being performed in the context of the user's session, which can lead to data theft, account compromise, and other security issues.
Yes, you can mitigate the risk by disabling the command palette and using the action API as the Search Gateway as a temporary measure.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for starcitizentools/citizen-skin.
