Citizen vulnerable to stored XSS in sticky header button messages

Summary The JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages. Details In the copyButtonAttributes function in stickyHeader.js, when copying the button labels, the innerHTML of the new...

GHSA-G955-VW6W-V6PP Citizen vulnerable to stored XSS in sticky header button messages

Summary The JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages. Details In the copyButtonAttributes function in stickyHeader.js, when copying the button labels, the innerHTML of the new...

CVE-2025-62508

CVE-2025-62508 affects the Citizen MediaWiki skin (versions 3.3.0–3.9.0). The issue is a stored XSS in the sticky header: in stickyHeader.js, copyButtonAttributes assigns innerHTML from the source element’s textContent, causing system messages (citizen-share, citizen-view-history, citizen-view-ed...