How to fix EUVD-2025-19907?

Within 7 days: Identify all affected systems running that makes extensions part of the cohesive experience. From and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Is Citizen affected by EUVD-2025-19907?

Organizations using that makes extensions part of the cohesive experience. From face significant risk from CVE-2025-53370, a cross-site scripting vulnerability rated CVSS 8.6.

Citizen EUVD-2025-19907

| CVE-2025-53370 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-07-03 [email protected]

GHSA-prmv-7r8c-794g

XSS Citizen

8.6

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 16, 2026 - 02:12 vuln.today

EUVD ID Assigned

Mar 16, 2026 - 02:12 euvd

EUVD-2025-19907

Patch released

Mar 16, 2026 - 02:12 nvd

Patch available

PoC Detected

Aug 22, 2025 - 14:19 vuln.today

Public exploit code

CVE Published

Jul 03, 2025 - 20:15 nvd

HIGH 8.6

DescriptionNVD

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.

Analysis

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

A vendor patch is available — apply it immediately. Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

EUVD-2025-19907 vulnerability details – vuln.today

Back