Detections
Analytics

SCA: security update for starcitizentools/citizen-skin (GHSA-g955-vw6w-v6pp)

medium Tenable Cloud Security Plugin ID 435682

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to
 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In
 stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s textContent
 when copying button labels. This causes escaped HTML in system message content (such as citizen-share,
 citizen-view-history, citizen-view-edit, and nstab-talk) to be interpreted as HTML in the sticky header,
 allowing injection of arbitrary script by a user with the ability to edit interface messages. The
 vulnerability allows a user with the editinterface right but without the editsitejs right (by default the
 sysop group has editinterface but may not have editsitejs) to execute arbitrary JavaScript in other users’
 sessions, enabling unauthorized access to sensitive data or actions. The issue is fixed in 3.9.0.
 (CVE-2025-62508)

See Also

https://github.com/advisories/GHSA-g955-vw6w-v6pp

Plugin Details

Severity: Medium

ID: 435682

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 10/21/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.21

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.7

Temporal Score: 5.7

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:N

CVSS Score Source: CVE-2025-62508

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/20/2025

Vulnerability Publication Date: 10/17/2025

Reference Information

CVE: CVE-2025-62508

cwe: CWE-79