CVE-2025-53370: StarCitizenTools Citizen Skin Stored XSS Vulnerability
Summary
CVE-2025-53370: Citizen vulnerable to Stored XSS through short descriptions. Affects starcitizentools/citizen-skin versions >= 1.9.4, < 3.4.0. Fixed in 3.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The StarCitizenTools Citizen skin is a popular extension for MediaWiki that enhances the user interface for Star Citizen-related content. It allows users to customize page appearances and includes features like short descriptions for pages. However, the integration of user-generated content without proper sanitization has led to a critical security vulnerability, exposing users to potential attacks.
Vulnerability Detail
The vulnerability arises from the ShortDescription extension, which allows users to set short descriptions that are inserted as raw HTML by the Citizen skin. This means that any user can inject arbitrary HTML into the DOM by editing a page. The unsanitized shortdesc property is retrieved from the OutputPage and returned as the tagline, which is then inserted into the template without escaping. This flaw can lead to stored cross-site scripting (XSS) attacks, where malicious scripts can be executed in the context of other users' browsers, potentially compromising user data and session integrity.
How To Fix
Minimum fixed version
3.4.0
This is the first release that contains the fix.
composer require starcitizentools/citizen-skin:3.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the ShortDescription extension until the package is updated. If you must use it, ensure that only trusted users can edit pages that include short descriptions to minimize the risk of XSS attacks.
Conclusion
The CVE-2025-53370 vulnerability in the StarCitizenTools Citizen skin poses a significant risk due to its potential for stored XSS attacks. Users are advised to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for starcitizentools/citizen-skin →
FAQ
The vulnerability is a stored cross-site scripting (XSS) flaw that allows users to insert arbitrary HTML into the DOM.
Any user of the StarCitizenTools Citizen skin who can edit pages with short descriptions is potentially affected.
Attackers can execute JavaScript in the context of other users' browsers, leading to data theft, session hijacking, or other malicious activities.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for starcitizentools/citizen-skin.
