CVE-2026-103974
CVE-2026-103974 · lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by authorText. When a study node has at least two comments, ui/analyse/src/treeView/inlineView.ts interpolates that author string into HTML passed to the innerHTML hook without escaping it. Opening the affected study can therefore render stored attacker-controlled HTML and CSS for other viewers, including navigation to an attacker-controlled site, content spoofing, and CSS-based data exposure, although the site's content security policy blocks injected JavaScript. This vulnerability is fixed by commit c54596c9e1569d378fe20f80d4c790c6fdee54c4.
CVSS 5.4 · Mittel · EPSS 0,2%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
lila
- Softwareversionen
- < c54596c9e1569d378fe20f80d4c790c6fdee54c4: Betroffen
Keine Korrektur veröffentlicht