What is the CVSS score of CVE-2025-53370?

CVE-2025-53370 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Citizen are affected by CVE-2025-53370?

Organizations using that makes extensions part of the cohesive experience. From face significant risk from CVE-2025-53370, a cross-site scripting vulnerability rated CVSS 8.6.. A patch is available.

Is there a public PoC exploit available for CVE-2025-53370?

Yes, a public proof-of-concept exploit is available for CVE-2025-53370. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-53370?

Within 7 days: Identify all affected systems running that makes extensions part of the cohesive experience. From and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Citizen CVE-2025-53370

EUVD-2025-19907 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-03 security-advisories@github.com

GHSA-prmv-7r8c-794g

XSS Citizen Starcitizen Tools

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 02:12 euvd

EUVD-2025-19907

Analysis Generated

Mar 16, 2026 - 02:12 vuln.today

Patch released

Mar 16, 2026 - 02:12 nvd

Patch available

PoC Detected

Aug 22, 2025 - 14:19 vuln.today

Public exploit code

CVE Published

Jul 03, 2025 - 20:15 nvd

HIGH 8.6

DescriptionGitHub Advisory

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.

Analysis

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

A vendor patch is available — apply it immediately. Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.