What is GHSA-g3cp-pq72-hjpv?

GHSA-g3cp-pq72-hjpv is a security advisory published by GitHub Security Advisories with Medium severity. starcitizentools/citizen-skin allows stored XSS in menu heading message

Which CVE IDs does GHSA-g3cp-pq72-hjpv cover?

GHSA-g3cp-pq72-hjpv covers the following CVE IDs: CVE-2025-49579. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g3cp-pq72-hjpv?

GHSA-g3cp-pq72-hjpv has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-g3cp-pq72-hjpv?

GHSA-g3cp-pq72-hjpv affects 1 product, including: composer/starcitizentools/citizen-skin:\u003e= 2.4.2, \u003c 3.3.1.

GHSA-g3cp-pq72-hjpvMediumCVSS 6.5

starcitizentools/citizen-skin allows stored XSS in menu heading message

Vendor

GitHub Security Advisories

Published

June 13, 2025

Last Modified

June 13, 2025

🔗 CVE IDs covered (1)

CVE-2025-49579 →

📋 Description

Summary

All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM.

Details

The system messages for menu headings are inserted unescaped into raw HTML: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/072e4365e9084e4b153eac62d3666566c06f5a49/templates/Menu.mustache#L8-L10

PoC

Go to any article using citizen with the uselang parameter set to x-xss
A large number of alerts will be shown for various messages, e.g.:

On the main page of my test wiki, the following messages were shown: navigation, notifications, user-interface-preferences, personaltools, variants, views, associated-pages, cactions and toolbox.

Impact

This impacts wikis where a group has the editinterface but not the editsitejs user right.

🎯 Affected products1

composer/starcitizentools/citizen-skin:>= 2.4.2, < 3.3.1