CVE-2025-53369: Starcitizentools/short description Cross-Site Scripting Vulnerability
HIGHCVE-2025-53369 is a HIGH (CVSS 8.6) cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Starcitizentools/short description libraries in the Packagist ecosystem. The issue involves citizen short description stored xss vulnerability through wikitext. Remediation is available by upgrading affected packages to version 4.0.1.
CVE-2025-53369 at a Glance
Security Impact
CVSS: 8.6
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
How to Fix CVE-2025-53369
To remediate this vulnerability, upgrade all affected Starcitizentools/short description dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade starcitizentools/short-description to 4.0.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for starcitizentools/short-descriptionHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-53369, inspect your project dependencies for Starcitizentools/short description:
inspect dependencies for starcitizentools/short-descriptionAnalyze the terminal output to locate any version of Starcitizentools/short description in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.0.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Starcitizentools/short description, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-53369 Affected Starcitizentools/short description Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
starcitizentools/short-description
|
Packagist |
≥ 4.0.0
< 4.0.1
|
4.0.1
|
References
Frequently Asked Questions
What is CVE-2025-53369?
Which Starcitizentools/short description versions are affected?
What version fixes CVE-2025-53369?
Is starcitizentools/short-description affected?
What is the CVSS score of CVE-2025-53369?
What CWE is associated with CVE-2025-53369?
How can I check Packagist dependencies for CVE-2025-53369?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-p85q-mww9-gwqf",
"modified" : "2025-07-03T21:38:37Z",
"published" : "2025-07-03T21:38:37Z",
"aliases" : [ "CVE-2025-53369" ],
"summary" : "Citizen Short Description stored XSS vulnerability through wikitext",
"details" : "### Summary\nShort descriptions are not properly sanitized by the ShortDescription before being inserted as HTML using `mw.util.addSubtitle`, allowing any user to insert arbitrary HTML into the DOM by editing a page.\n\n### Details\nThe description provided by the user via the `{{SHORTDESC:}}` parser function is insufficiently sanitized by the `sanitize()` function, as html entities are decoded:\nhttps://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/includes/Hooks/ParserHooks.php#L147-L159\nVia JS, the short description is then passed to `mw.util.addSubtitle`, which inserts it as raw HTML:\nhttps://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/modules/ext.shortDescription.js#L8\nhttps://github.com/wikimedia/mediawiki/blob/96372101b3c579d9992e8a31a3ccd90a937cac47/resources/src/mediawiki.util/util.js#L552-L563\n\n### PoC\n1. Enable ShortDescription\n2. Make sure `$wgShortDescriptionEnableTagline` is set to `true` (this is the default)\n3. Create a page and insert the following wikitext: `{{SHORTDESC:<img src=\"\" onerror=\"alert('shortdescription xss')\">}}`\n4. Visit the page\n\n\n\n\n\n### Impact\nArbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "starcitizentools/short-description"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0.0"
}, {
"fixed" : "4.0.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/security/advisories/GHSA-p85q-mww9-gwqf"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-53369"
}, {
"type" : "WEB",
"url" : "https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/commit/bc4fdbaeb1dff127fb6d08c0d385b64aa128c8f8"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-07-03T21:38:37Z",
"nvd_published_at" : "2025-07-03T20:15:23Z"
}
}