CVE-2026-103974

CVE-2026-103974 · lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies

This page contains facts from public vulnerability sources. Check the original advisory before updating.

lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by authorText. When a study node has at least two comments, ui/analyse/src/treeView/inlineView.ts interpolates that author string into HTML passed to the innerHTML hook without escaping it. Opening the affected study can therefore render stored attacker-controlled HTML and CSS for other viewers, including navigation to an attacker-controlled site, content spoofing, and CSS-based data exposure, although the site's content security policy blocks injected JavaScript. This vulnerability is fixed by commit c54596c9e1569d378fe20f80d4c790c6fdee54c4.

CVSS 5.4 · Medium · EPSS 0.2%

Published

2026-10-14T18:17:13.770Z

Updated

2026-10-14T19:41:15.577Z

Check your server →