Packagist/starcitizentools/citizen-skin CVE-2025-62508: medium 6.5, EPSS 0.45%

Citizen vulnerable to stored XSS in sticky header button messages

Action: Upgrade starcitizentools/citizen-skin to 3.9.0 or later.

composer require starcitizentools/citizen-skin:3.9.0

Affected

Fixed versions

Sources

• osv: GHSA-g955-vw6w-v6pp
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g955-vw6w-v6pp
• https://nvd.nist.gov/vuln/detail/CVE-2025-62508
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/e006923c6dbf113c9a025ca186ecc09fe7b93a15
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/fbb1d4fe9627281567706f3f6fc99a42ce16fdc4
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen

CVE-2025-62508 · published 2025-10-20T15:31:06Z · modified 2025-10-20T16:17:56.550386Z · JSON