p PatchFirst

CVE-2025-49575

CVE-2025-49575 · Citizen allows stored XSS in Command Palette tip messages

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.

CVSS 6.5 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • mediawiki-skins-citizen

    Versions
    • >= 4fa69e1d062dca7e407cc0530cf1da3e2baaf0b5, < 93c36ac778397e0e7c46cf7adb1e5d848265f1bd: Affected
    • >= 3.2.0, < 3.3.1: Affected

    No fix published

  • starcitizentools/citizen-skin Packagist

    Versions
    • v2.10.0
    • v2.10.1
    • v2.11.0
    • v2.11.1
    • v2.12.0
    • v2.13.0
    • v2.13.1
    • v2.13.2
    • v2.13.3
    • v2.13.4
    • v2.13.5
    • v2.14.0
    • v2.14.1
    • v2.15.0
    • v2.15.1
    • v2.16.0
    • v2.16.1
    • v2.17.0
    • v2.17.1
    • v2.17.2
    • v2.18.0
    • v2.18.1
    • v2.19.0
    • v2.20.0
    • v2.21.0
    • v2.22.0
    • v2.22.1
    • v2.23.0
    • v2.24.0
    • v2.25.0
    • v2.26.0
    • v2.27.0
    • v2.28.0
    • v2.29.0
    • v2.30.0
    • v2.31.0
    • v2.32.0
    • v2.33.0
    • v2.34.0
    • v2.35.0
    • v2.36.0
    • v2.37.0
    • v2.38.0
    • v2.38.1
    • v2.38.2
    • v2.38.3
    • v2.39.0
    • v2.39.1
    • v2.39.2
    • v2.39.3
    • v2.39.4
    • v2.4.2
    • v2.4.3
    • v2.4.4
    • v2.40.0
    • v2.40.1
    • v2.40.2
    • v2.5.0
    • v2.5.1
    • v2.5.2
    • v2.6.0
    • v2.6.1
    • v2.6.2
    • v2.6.3
    • v2.6.4
    • v2.6.5
    • v2.6.6
    • v2.7.0
    • v2.7.1
    • v2.7.10
    • v2.7.11
    • v2.7.2
    • v2.7.3
    • v2.7.4
    • v2.7.5
    • v2.7.6
    • v2.7.7
    • v2.7.8
    • v2.7.9
    • v2.8.0
    • v2.8.1
    • v2.8.2
    • v2.8.3
    • v2.8.4
    • v2.8.5
    • v2.9.0
    • v2.9.1
    • v3.0.0
    • v3.1.0
    • v3.2.0
    • v3.3.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.2, < 3.3.1

    Update to 3.3.1

Original sources

Check your server →