Summary

Short descriptions are not properly sanitized by the ShortDescription before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page.

Details

The description provided by the user via the {{SHORTDESC:}} parser function is insufficiently sanitized by the sanitize() function, as html entities are decoded:
https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/includes/Hooks/ParserHooks.php#L147-L159
Via JS, the short description is then passed to mw.util.addSubtitle, which inserts it as raw HTML:
https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/modules/ext.shortDescription.js#L8
https://github.com/wikimedia/mediawiki/blob/96372101b3c579d9992e8a31a3ccd90a937cac47/resources/src/mediawiki.util/util.js#L552-L563

PoC

1. Enable ShortDescription
2. Make sure $wgShortDescriptionEnableTagline is set to true (this is the default)
3. Create a page and insert the following wikitext: {{SHORTDESC:<img src="" onerror="alert('shortdescription xss')">}}
4. Visit the page

Impact

Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.

References

• GHSA-p85q-mww9-gwqf
• https://nvd.nist.gov/vuln/detail/CVE-2025-53369
• StarCitizenTools/mediawiki-extensions-ShortDescription@bc4fdba