CVE-2026-103974 Details
Description
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by authorText. When a study node has at least two comments, ui/analyse/src/treeView/inlineView.ts interpolates that author string into HTML passed to the innerHTML hook without escaping it. Opening the affected study can therefore render stored attacker-controlled HTML and CSS for other viewers, including navigation to an attacker-controlled site, content spoofing, and CSS-based data exposure, although the site's content security policy blocks injected JavaScript. This vulnerability is fixed by commit c54596c9e1569d378fe20f80d4c790c6fdee54c4.
A stored HTML injection vulnerability has been identified in Lichess, an open-source chess server. This issue allows users who can add chapters to studies to inject arbitrary HTML into comments, which is then rendered without proper escaping. The vulnerability affects versions prior to the commit c54596c9e1569d378fe20f80d4c790c6fdee54c4. When a study node contains at least two comments, the injected HTML can be executed, potentially leading to content spoofing, CSS-based data exposure, and navigation to attacker-controlled sites. Although the site's content security policy blocks injected JavaScript, the vulnerability can still be exploited by using certain HTML tags, such as meta tags, to achieve similar effects.
Users should update to the version containing the patch for this vulnerability, which is available in the commit c54596c9e1569d378fe20f80d4c790c6fdee54c4.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lichess-org/lila/security/advisories/GHSA-43g7-r6hp-ccf8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/lichess-org/lila/commit/c54596c9e1569d378fe20f80d4c790c6fdee54c4 | [email protected] | Source CodeVendor |
| https://github.com/lichess-org/lila/security/advisories/GHSA-43g7-r6hp-ccf8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lichess.org | b2c355cd45f823e31e92aa56ca2ca162e979909a |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |