{"id":"GHSA-4c2h-67qq-vm87","summary":"Citizen skin vulnerable to stored XSS through multiple system messages","details":"### Summary\nMultiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.\n\n### Details\nThe messages are retrieved using the `plain()` output mode: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L61-L66\n`currentTip` is set to one of these messages: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L69\n`currentTip` is inserted as raw HTML (`vue/no-v-html` should *not* be ignored here): https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/resources/skins.citizen.commandPalette/components/CommandPaletteFooter.vue#L3-L4\n\n### PoC\n1. Edit `citizen-command-palette-tip-commands`, `citizen-command-palette-tip-users`, `citizen-command-palette-tip-namespace` and `citizen-command-palette-tip-templates` to `\u003cimg src=\"\" onerror=\"alert(1)\"\u003e` (script tags don't work here due to the way the HTML is inserted)\n2. Open the command palette\n![image](https://github.com/user-attachments/assets/f07b238b-1ac1-4781-8d03-db755ba04546)\n\n### Impact\nThis impacts wikis where a group has the `editinterface` but not the `editsitejs` user right.","aliases":["CVE-2025-49575"],"modified":"2025-06-13T04:30:31.802497Z","published":"2025-06-11T19:59:54Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-06-11T19:59:54Z","nvd_published_at":"2025-06-12T19:15:20Z"},"references":[{"type":"WEB","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-4c2h-67qq-vm87"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49575"},{"type":"WEB","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/4fa69e1d062dca7e407cc0530cf1da3e2baaf0b5"},{"type":"WEB","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/54c8717d45ce1594918f11cb9ce5d0ccd8dfee65"},{"type":"WEB","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd"},{"type":"PACKAGE","url":"https://github.com/StarCitizenTools/mediawiki-skins-Citizen"}],"affected":[{"package":{"name":"starcitizentools/citizen-skin","ecosystem":"Packagist","purl":"pkg:composer/starcitizentools/citizen-skin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2"},{"fixed":"3.3.1"}]}],"versions":["v2.10.0","v2.10.1","v2.11.0","v2.11.1","v2.12.0","v2.13.0","v2.13.1","v2.13.2","v2.13.3","v2.13.4","v2.13.5","v2.14.0","v2.14.1","v2.15.0","v2.15.1","v2.16.0","v2.16.1","v2.17.0","v2.17.1","v2.17.2","v2.18.0","v2.18.1","v2.19.0","v2.20.0","v2.21.0","v2.22.0","v2.22.1","v2.23.0","v2.24.0","v2.25.0","v2.26.0","v2.27.0","v2.28.0","v2.29.0","v2.30.0","v2.31.0","v2.32.0","v2.33.0","v2.34.0","v2.35.0","v2.36.0","v2.37.0","v2.38.0","v2.38.1","v2.38.2","v2.38.3","v2.39.0","v2.39.1","v2.39.2","v2.39.3","v2.39.4","v2.4.2","v2.4.3","v2.4.4","v2.40.0","v2.40.1","v2.40.2","v2.5.0","v2.5.1","v2.5.2","v2.6.0","v2.6.1","v2.6.2","v2.6.3","v2.6.4","v2.6.5","v2.6.6","v2.7.0","v2.7.1","v2.7.10","v2.7.11","v2.7.2","v2.7.3","v2.7.4","v2.7.5","v2.7.6","v2.7.7","v2.7.8","v2.7.9","v2.8.0","v2.8.1","v2.8.2","v2.8.3","v2.8.4","v2.8.5","v2.9.0","v2.9.1","v3.0.0","v3.1.0","v3.2.0","v3.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-4c2h-67qq-vm87/GHSA-4c2h-67qq-vm87.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"}]}