CVE-2025-53369: StarCitizenTools Short Description XSS Vulnerability
Summary
CVE-2025-53369: Citizen Short Description stored XSS vulnerability through wikitext. Affects starcitizentools/short-description versions >= 4.0.0, < 4.0.1. Fixed in 4.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The StarCitizenTools Short Description package is an extension for MediaWiki that allows users to add short descriptions to pages. This functionality enhances the user experience by providing concise information about the content. However, the package has a vulnerability that allows users to insert arbitrary HTML into the DOM, potentially leading to security issues such as cross-site scripting (XSS).
Vulnerability Detail
The vulnerability arises from insufficient sanitization of user input in the ShortDescription feature. Specifically, the description provided via the {{SHORTDESC:}} parser function is not adequately sanitized, allowing HTML entities to be decoded. This leads to the insertion of raw HTML into the DOM through mw.util.addSubtitle, making it possible for any user to execute arbitrary JavaScript. The implications of this vulnerability are severe, as it can allow attackers to execute scripts in the context of other users' sessions, potentially leading to data theft or other malicious activities.
How To Fix
Minimum fixed version
4.0.1
This is the first release that contains the fix.
composer require starcitizentools/short-description:4.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the ShortDescription feature in your MediaWiki configuration until the package is updated. This can be done by setting the following configuration in your LocalSettings.php file: $wgShortDescriptionEnableTagline = false;
Conclusion
The CVE-2025-53369 vulnerability in the StarCitizenTools Short Description package poses a significant risk due to its ability to allow arbitrary HTML injection. Users are advised to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for starcitizentools/short-description →
FAQ
The vulnerability is a stored XSS issue that allows users to inject arbitrary HTML into the DOM.
Any user of the StarCitizenTools Short Description package who has access to edit pages can potentially exploit this vulnerability.
The consequences include the possibility of executing malicious JavaScript in the context of other users' sessions, leading to data theft or other security breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
