Citizen is vulnerable to stored XSS attack in the legacy search bar

Vulnerability

CVE-2025-53368 is a stored cross-site scripting (XSS) vulnerability in the Citizen MediaWiki skin, affecting versions from 1.9.4 up to (but not including) 3.4.0 [1][2]. The issue occurs in the old (legacy) search bar module, where page descriptions retrieved from sources such as TextExtracts or Description2 are inserted directly into the DOM as raw HTML without escaping or sanitization [2]. Specifically, the template {{{.}}} renders user-controlled description content verbatim [2].

Exploitation

Any user with the ability to create or edit pages can exploit this by inserting an XSS payload (e.g., `) into a page's description. An attacker must also ensure the wiki is configured with the command palette disabled ($wgCitizenEnableCommandPalette = false;), the Action API as the search gateway ($wgCitizenSearchGateway = 'mwActionApi';), and a supported description source enabled (such as TextExtracts with $wgCitizenSearchDescriptionSource = 'textextracts'; or Description2 with $wgCitizenSearchDescriptionSource = 'pagedescription';`) [2]. When another user opens the search modal and looks for the affected page, the malicious description is rendered, executing the attacker's script in the context of the searching user's session [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other wiki users who search for specific pages. This can lead to session hijacking, defacement, theft of sensitive cookies or tokens, or further actions under the victim's credentials [1][2]. The vulnerability does not require the victim to have any special privileges beyond being able to search on the wiki.

Mitigation

The vulnerability has been fixed in Citizen skin version 3.4.0, released on 2025-07-03 [1][4]. The fix sanitizes search result descriptions in the old search module and also addresses a related tagline XSS (CVE-2025-53370) [4]. Administrators are strongly advised to update to version 3.4.0 or later. For installations that cannot immediately upgrade, disabling the legacy search bar or ensuring description sources are not enabled may serve as temporary mitigations, though patching is the recommended action [4].