{"action":"Upgrade starcitizentools/citizen-skin to 3.9.0 or later.","affected":[{"fixed":"3.9.0","introduced":"3.3.0"}],"component":"starcitizentools/citizen-skin","cve_ids":["CVE-2025-62508"],"ecosystem":"Packagist","epss":0.00448,"exploited":false,"fixed_versions":["3.9.0"],"ghsa_id":"GHSA-g955-vw6w-v6pp","id":"tcs_01M5KF2HM45MG05AEZXN2WJTB2","modified_at":"2025-10-20T16:17:56.550386Z","published_at":"2025-10-20T15:31:06Z","references":["https://osv.dev/vulnerability/GHSA-g955-vw6w-v6pp","https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g955-vw6w-v6pp","https://nvd.nist.gov/vuln/detail/CVE-2025-62508","https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/e006923c6dbf113c9a025ca186ecc09fe7b93a15","https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/fbb1d4fe9627281567706f3f6fc99a42ce16fdc4","https://github.com/StarCitizenTools/mediawiki-skins-Citizen"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-g955-vw6w-v6pp","url":"https://osv.dev/vulnerability/GHSA-g955-vw6w-v6pp"}],"summary":"Citizen vulnerable to stored XSS in sticky header button messages"}