Skip to content
OpenAdvisories

Vendor

lichess-org

2 known vulnerabilities.

Products

lila 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-103974

    lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies

    lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.E…

    lichess-org lila
  • Medium 5.3
    CVE-2026-35208

    lichess.org has an Unsanitized Stream Title Injection on /streamer

    lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live streams” widget by placing markup in their Twitch/YouTube stream title. CSP is present and blocks inlin…

    lichess-org lila