CVE-2025-53369: Citizen Short Description stored XSS vulnerability through wikitext
Summary Short descriptions are not properly sanitized by the ShortDescription before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page.
Details The description provided by the user via the {{SHORTDESC:}} parser function is insufficiently sanitized by the sanitize() function, as html entities are decoded: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/includes/Hooks/ParserHooks.php#L147-L159 Via JS, the short description is then passed to mw.util.addSubtitle, which inserts it as raw HTML: https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/modules/ext.shortDescription.js#L8 https://github.com/wikimedia/mediawiki/blob/96372101b3c579d9992e8a31a3ccd90a937cac47/resources/src/mediawiki.util/util.js#L552-L563
PoC 1. Enable ShortDescription 2. Make sure $wgShortDescriptionEnableTagline is set to true (this is the default) 3. Create a page and insert the following wikitext: {{SHORTDESC:<img src="" onerror="alert('shortdescription xss')">}} 4. Visit the page
!image !image
Impact Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.
Other sources
Citizen Short Description stored XSS vulnerability through wikitext
— Packagist
Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 4.0.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/starcitizentools/short-descriptionto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
MediaWiki ShortDescription extensionto a version that resolves this vulnerability.Fixed in 4.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53369?
CVE-2025-53369 is considered a high severity vulnerability due to its potential for arbitrary HTML injection.
How do I fix CVE-2025-53369?
To fix CVE-2025-53369, upgrade the MediaWiki Short Description extension to a version higher than 4.0.0.
Who is affected by CVE-2025-53369?
Users of MediaWiki Short Description extension version 4.0.0 are affected by CVE-2025-53369.
What type of vulnerability is CVE-2025-53369?
CVE-2025-53369 is a vulnerability related to inadequate input sanitization that allows for HTML injection.
Can arbitrary users exploit CVE-2025-53369?
Yes, any user with editing privileges can exploit CVE-2025-53369 to inject arbitrary HTML.