CVE-2024-36123: Starcitizen.tools Citizen

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.

Affected products

• Starcitizen.tools Citizen: before 2.16.0 (fixed in 2.16.0)

Published 2024-06-03. Last modified 2026-06-17.