What is GHSA-2v3v-3whp-953h?

GHSA-2v3v-3whp-953h is a security advisory published by GitHub Security Advisories with Medium severity. starcitizentools/citizen-skin allows stored XSS in user registration date message

Which CVE IDs does GHSA-2v3v-3whp-953h cover?

GHSA-2v3v-3whp-953h covers the following CVE IDs: CVE-2025-49578. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2v3v-3whp-953h?

GHSA-2v3v-3whp-953h has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-2v3v-3whp-953h?

GHSA-2v3v-3whp-953h affects 1 product, including: composer/starcitizentools/citizen-skin:\u003e= 3.3.0, \u003c 3.3.1.

GHSA-2v3v-3whp-953hMediumCVSS 6.5

starcitizentools/citizen-skin allows stored XSS in user registration date message

Vendor

GitHub Security Advisories

Published

June 13, 2025

Last Modified

June 13, 2025

🔗 CVE IDs covered (1)

CVE-2025-49578 →

📋 Description

Summary

Various date messages returned by Language::userDate are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

Details

The result of $this->lang->userDate( $timestamp, $this->user ) returns unescaped values, but is inserted as raw HTML by Citizen: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/includes/Components/CitizenComponentUserInfo.php#L55-L60

PoC

Go to any page using citizen with the uselang parameter set to x-xss and while being logged in Depending on the registration date of the account you're logged in with, various messages can be shown. In my case, it's november:

Impact

This impacts wikis where a group has the editinterface but not the editsitejs user right.

🎯 Affected products1

composer/starcitizentools/citizen-skin:>= 3.3.0, < 3.3.1