{"id":"GHSA-g955-vw6w-v6pp","aliases":["CVE-2025-62508"],"title":"Citizen vulnerable to stored XSS in sticky header button messages","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Summary\nThe JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages.\n\n### Details\nIn the `copyButtonAttributes` function in `stickyHeader.js`, when copying the button labels, the `innerHTML` of the new element is set to the `textContent` of the old element:\nhttps://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/f4cbcecf5aca0ae69966b23d4983f9cb5033f319/resources/skins.citizen.scripts/stickyHeader.js#L29-L41\nThis unescapes any escaped HTML characters and causes the contents of the system messages to be interpreted as HTML.\n\n### PoC\n1. Edit any of the affected messages (`citizen-share`, `citizen-view-history`, `citizen-view-edit`, `nstab-talk`) to the following payload: `<img src=\"\" onerror=\"alert('Sticky Header Button XSS')\">`.\n2. Visit any mainpage article in the wiki using the Citizen skin.\n\n<img width=\"495\" height=\"228\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ac75b8e1-b181-4335-9526-17d6b6f8518e\" />\n<img width=\"569\" height=\"157\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c052edb9-ff68-4869-9c66-3ec85e7ff68a\" />\n\n\n### Impact\nThis impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. By default, this is the case for the `sysop` group.","severity":"medium","score":6.5,"published":"2025-10-20T15:31:06.000Z","modified":"2025-10-20T16:17:56.550Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"starcitizentools/citizen-skin","sources":[{"name":"OSV · GHSA-g955-vw6w-v6pp","url":"https://osv.dev/vulnerability/GHSA-g955-vw6w-v6pp"}],"ranges":[{"events":[{"introduced":"3.3.0"},{"fixed":"3.9.0"}],"type":"ECOSYSTEM"}],"versions":["v3.3.0","v3.3.1","v3.3.2","v3.4.0","v3.5.0","v3.6.0","v3.7.0","v3.8.0"],"fixed":["3.9.0"]}],"sourceAffected":[],"references":["https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g955-vw6w-v6pp","https://nvd.nist.gov/vuln/detail/CVE-2025-62508","https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/e006923c6dbf113c9a025ca186ecc09fe7b93a15","https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/fbb1d4fe9627281567706f3f6fc99a42ce16fdc4","https://github.com/StarCitizenTools/mediawiki-skins-Citizen"],"sources":[{"name":"OSV","id":"GHSA-g955-vw6w-v6pp","modified":"2025-10-20T16:17:56.550386Z","url":"https://osv.dev/vulnerability/GHSA-g955-vw6w-v6pp"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T19:25:35.956Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}