CVE-2025-62508: Stored XSS Vulnerability in StarCitizenTools Citizen Skin Package
Summary
CVE-2025-62508: Citizen vulnerable to stored XSS in sticky header button messages. Affects starcitizentools/citizen-skin versions >= 3.3.0, < 3.9.0. Fixed in 3.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The StarCitizenTools Citizen Skin package is a popular skin for MediaWiki that enhances the user interface for Star Citizen-related wikis. It provides various features, including customizable buttons and a sticky header for improved navigation. However, it has a vulnerability that allows for stored cross-site scripting (XSS) attacks, which can compromise the security of wikis using this skin.
Vulnerability Detail
The vulnerability arises from the copyButtonAttributes function in the stickyHeader.js file, where HTML characters are unescaped when copying button labels. This allows malicious users to inject HTML content into system messages, leading to stored XSS. If exploited, an attacker could execute arbitrary JavaScript in the context of the user's session, potentially compromising sensitive information or user accounts.
How To Fix
Minimum fixed version
3.9.0
This is the first release that contains the fix.
composer require starcitizentools/citizen-skin:3.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict the user permissions for editing system messages to prevent unauthorized users from injecting malicious content. Ensure that only trusted users have the editinterface permission.
Conclusion
The stored XSS vulnerability in the StarCitizenTools Citizen Skin package poses a significant risk to wikis utilizing this skin. It is crucial to update to the patched version to mitigate potential attacks. Additionally, employing workarounds can help secure the application until the update is applied.
See every vulnerability recorded for starcitizentools/citizen-skin →
FAQ
CVE-2025-62508 is a stored XSS vulnerability found in the StarCitizenTools Citizen Skin package, which can allow attackers to execute malicious scripts.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
If exploited, this vulnerability can lead to unauthorized access to user sessions, data theft, and the ability to manipulate the content displayed to users.
Yes, a patch is available in version 3.9.0 of the StarCitizenTools Citizen Skin package. Updating to this version will resolve the issue.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for starcitizentools/citizen-skin.
