CVE-2025-49578: Citizen allows stored XSS in user registration date message

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-06-12 · updated 2026-06-17
Weakness: CWE-79

Description

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.

Affected products

StarCitizenTools mediawiki-skins-Citizen: before 3.3.1 — fixed in 3.3.1

How to fix

Upgrade to a fixed version: StarCitizenTools mediawiki-skins-Citizen 3.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-49578 or the next vulnerability affects your stack