ByteOS Network

NVD Vulnerability Details :

CVE-2025-53368

Analyzed

Source-security-advisories@github.com

Published At-03 Jul, 2025 | 20:15

Updated At-22 Aug, 2025 | 14:20

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Primary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CPE Matches

starcitizen.tools>>citizen>>Versions from 1.9.4(inclusive) to 3.4.0(exclusive)

cpe:2.3:a:starcitizen.tools:citizen:*:*:*:*:*:mediawiki:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/aedbceb3380bb48db6b59e272fc187529c71c8ca	security-advisories@github.com	Patch
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases/tag/v3.4.0	security-advisories@github.com	Release Notes
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-rq6g-6g94-jfr4	security-advisories@github.com	Exploit Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History