CVE-2024-47536 starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
A user can inject malicious scripts via the real name field, leading to self-XSS in the Citizen MediaWiki skin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-47536?
CVE-2024-47536 is a medium-severity cross-site scripting vulnerability in StarCitizenTools mediawiki-skins-Citizen, published on 30 Sep 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.
Which versions are affected by CVE-2024-47536?
2 open source packages ship an affected version, including starcitizentools/citizen-skin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
starcitizentools/citizen-skin Packagist | From 2.6.3 | 2.31.0 |
starcitizentools/citizen-skin Packagist | From 2.6.3 | 2.31.0 |
Products include Starcitizen.tools Citizen.
How do I fix CVE-2024-47536?
Upgrade starcitizentools/citizen-skin to 2.31.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47536 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-47536 exists.
Other vulnerabilities in StarCitizenTools mediawiki-skins-Citizen
- CVE-2025-53368 Citizen is vulnerable to stored XSS attack in the legacy search bar
- CVE-2025-53370 Citizen stored XSS vulnerability through short descriptions
- CVE-2025-49575 Citizen allows stored XSS in Command Palette tip messages
- CVE-2025-49576 Citizen allows stored XSS in search no result messages
- CVE-2025-49577 Citizen allows stored XSS in preference menu headings
Sources
Also known as GHSA-62r2-gcxr-426x.