Citizen stored XSS vulnerability through short descriptions

Vulnerability

Analysis

The Citizen skin for MediaWiki, from version 1.9.4 to before 3.4.0, fails to sanitize the html-tagline variable that is derived from the shortdesc property of the page. The short description, typically set via the ShortDescription extension using the {{SHORTDESC:...}} parser function, is retrieved from $this->out->getProperty( 'shortdesc' ) and passed directly into template data without escaping. The template then inserts this value into {{{html-tagline}}}, which renders it as raw HTML in the page DOM [2].

Exploitation

An attacker with any level of edit access on a wiki (including unprivileged users, as the skin does not enforce any special rights for setting short descriptions) can inject arbitrary HTML. The proof of concept involves adding {{SHORTDESC:}} to any editable page. When another user visits that page, the unsanitized short description is rendered, executing the attacker's HTML or JavaScript in the victim's browser [2]. No special authentication or network position is required beyond normal editing permissions.

Impact

Successful exploitation enables stored cross-site scripting (XSS) [1]. This allows the attacker to execute arbitrary JavaScript in the context of the wiki, potentially stealing session cookies, modifying page content, performing actions on behalf of the victim, or escalating privileges depending on the wiki's configuration and the attacker's existing permissions.

Mitigation

The vulnerability has been patched in Citizen version 3.4.0, released on July 3, 2025, which sanitizes the short description output before rendering [4]. Administrators are strongly advised to upgrade to 3.4.0 or later immediately. No other workarounds are documented.