CVE-2025-53368
Last modified
CVE-2025-53368 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Starcitizen.Tools | Citizen | >= 1.9.4, < 3.4.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-53368?
How severe is CVE-2025-53368?
How do I fix CVE-2025-53368?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-53360pluginsGLPI's Database Inventory Plugin "manages" the Teclib…4.3
- CVE-2025-53363dpanel is an open source server management panel written in …4.8
- CVE-2025-53364Parse Server is an open source backend that can be deployed …5.3
- CVE-2025-53365The MCP Python SDK, called `mcp` on PyPI, is a Python implem…8.7
- CVE-2025-53366The MCP Python SDK, called `mcp` on PyPI, is a Python implem…8.7
- CVE-2025-53367DjVuLibre is a GPL implementation of DjVu, a web-centric for…8.4
- CVE-2025-53369Short Description is a MediaWiki extension that provides loc…8.6
- CVE-2025-5337The Slider, Gallery, and Carousel by MetaSlider plugin for W…5.4
- CVE-2025-53370Citizen is a MediaWiki skin that makes extensions part of th…5.4
- CVE-2025-53371DiscordNotifications is an extension for MediaWiki that send…9.1
- CVE-2025-53372node-code-sandbox-mcp is a Node.js–based Model Context Proto…7.5
- CVE-2025-53373Natours is a Tour Booking API. The attacker can easily take …8.9
Are you affected by CVE-2025-53368?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST