Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

starcitizentools/citizen-skin

9 known vulnerabilities (2 high, 7 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 2 high, 7 medium
Registry
Packagist

Advisories 9

  • CVE-2025-62508Medium 6.5

    Citizen vulnerable to stored XSS in sticky header button messages

    Affected: from 3.3.0, fixed in 3.9.0.

  • Citizen stored XSS vulnerability through short descriptions

    Affected: from 1.9.4, fixed in 3.4.0.

  • Citizen is vulnerable to stored XSS attack in the legacy search bar

    Affected: from 1.9.4, fixed in 3.4.0.

  • CVE-2025-49576Medium 6.5

    Citizen allows stored XSS in search no result messages

    Affected: from 2.31.0, fixed in 3.3.1.

  • CVE-2025-49578Medium 6.5

    Citizen allows stored XSS in user registration date message

    Affected: from 3.3.0, fixed in 3.3.1.

  • CVE-2025-49579Medium 6.5

    Citizen allows stored XSS in menu heading message

    Affected: from 2.4.2, fixed in 3.3.1.

  • CVE-2025-49575Medium 6.5

    Citizen allows stored XSS in Command Palette tip messages

    Affected: from 2.4.2, fixed in 3.3.1.

  • CVE-2025-49577Medium 6.5

    Citizen allows stored XSS in preference menu headings

    Affected: from 2.13.0, fixed in 3.3.1.

  • CVE-2024-47536Medium 4.8

    starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field

    Affected: from 2.6.3, fixed in 2.31.0.