CVE-2025-49577: 
PHP vulnerability analysis and mitigation

CVE-2025-49577 is a stored Cross-Site Scripting (XSS) vulnerability in the Citizen skin for MediaWiki, allowing users with message-editing privileges to inject arbitrary HTML into the DOM via unsanitized preference menu heading messages. It affects starcitizentools/citizen-skin versions >= 2.13.0 and < 3.3.1. The vulnerability was published on June 11, 2025, by the maintainer (alistair3149) and added to the GitHub Advisory Database on June 13, 2025. It carries a CVSS v3.1 base score of 6.5 (Moderate) per the GitHub Advisory (Github Advisory, Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-80 (Improper Neutralization of Script-Related HTML Tags). In resources/skins.citizen.preferences/addPortlet.polyfill.js, the label div's innerHTML was set to label.textContent, which effectively unsanitizes system messages: labelDiv.innerHTML = label.textContent || '';. This allows any user with permission to edit MediaWiki system messages (e.g., citizen-feature-custom-font-size-name) to embed arbitrary HTML — including event-handler-based XSS payloads — that executes when other users open the preferences menu. Script tags alone do not work due to how the HTML is inserted, but other HTML-based XSS vectors (e.g., <img onerror=...>) are viable (Security Advisory, Patch Commit).

Successful exploitation enables an attacker with message-editing privileges to inject malicious HTML/JavaScript into the preferences menu, affecting any user who opens that menu. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, and exfiltration of sensitive information accessible within the browser context. Availability is not impacted, but confidentiality and integrity are both at risk (Github Advisory, Security Advisory).

A proof-of-concept is publicly documented in the security advisory, demonstrating exploitation by editing a system message such as citizen-feature-custom-font-size-name to include a malicious HTML payload. Exploitation requires high privileges (message-editing rights on the MediaWiki instance) and no user interaction beyond the victim opening the preferences menu. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.028% (Feedly) to 0.156% (GitHub Advisory), indicating low near-term exploitation probability (Github Advisory, Security Advisory).

1. Gain message-editing access: Obtain an account on the target MediaWiki instance with privileges to edit system interface messages (typically requires editinterface or administrator rights).
2. Identify a vulnerable message: Navigate to a system message displayed as a heading in the Citizen preferences menu, such as MediaWiki:citizen-feature-custom-font-size-name.
3. Inject malicious HTML payload: Edit the message to include an HTML-based XSS payload (note: <script> tags are blocked by the insertion mechanism, so use event-handler vectors such as <img src=x onerror=alert(document.cookie)> or similar).
4. Wait for victim interaction: When any authenticated user opens the Citizen preferences menu, the injected HTML is rendered via innerHTML, triggering the payload in their browser context.
5. Achieve objective: The executed script can steal session cookies, perform actions as the victim, or exfiltrate data accessible to the victim's session (Security Advisory, Patch Commit).

• Logs: MediaWiki edit logs showing modifications to system interface messages (e.g., MediaWiki:citizen-feature-custom-font-size-name or similar citizen-* preference messages) by non-administrative or unexpected accounts.
• File System / Database: Unexpected HTML content (especially event handler attributes like onerror, onload, onclick) stored in MediaWiki's text or revision tables for interface messages in the MediaWiki: namespace.
• Network: Outbound requests from victim browsers to attacker-controlled domains originating from pages containing the Citizen preferences menu (visible in server access logs or browser network traces).
• Browser: Unexpected JavaScript execution or network requests triggered when users open the Citizen skin preferences menu.

Upgrade the Citizen MediaWiki skin to version 3.3.1 or later, which replaces the unsafe innerHTML assignment with textContent and applies proper escaping across multiple affected components (Patch Commit). As an interim workaround, restrict the editinterface permission to only highly trusted administrators to prevent unauthorized modification of system messages. Additionally, audit existing MediaWiki interface messages in the citizen-* namespace for any injected HTML content (Github Advisory).

The vulnerability was reported by community researcher SomeMWDev and promptly addressed by maintainer alistair3149 with a patch released the same day as disclosure (June 11, 2025). RedPacketSecurity noted the advisory on Mastodon shortly after publication. No significant broader media coverage or vendor statements beyond the GitHub advisory have been identified.