CVE-2025-49576: Citizen allows stored XSS in search no result messages

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-06-12 · updated 2026-06-17
Weakness: CWE-79

Description

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.

Affected products

StarCitizenTools mediawiki-skins-Citizen: before 3.3.1 — fixed in 3.3.1

How to fix

Upgrade to a fixed version: StarCitizenTools mediawiki-skins-Citizen 3.3.1. Check the vendor advisory for mitigations.

References

https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/a0296afaedbe1a277337a2d8f1da83cb3a79b9ab
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-86xf-2mgp-gv3g

Get alerted when CVE-2025-49576 or the next vulnerability affects your stack