Lichess CVE-2026-103974

Requires an authenticated lichess user who has permission to add a chapter to a study (contributor/owner of a shared study), who places attacker-controlled HTML/CSS in the PGN 'Annotator' tag - stored as Comment.Author.External and emitted by authorText(). The vulnerable rendering path in inlineView.ts triggers only when a study node has at least two comments, and the payload executes only when another user opens the affected study (UI:R). Exploitation is meaningfully LIMITED: the site's Content Security Policy blocks injected JavaScript, so impact is confined to stored HTML/CSS injection - content spoofing, navigation to attacker-controlled sites, and CSS-based data exposure - rather than script execution, cookie theft, or session takeover.

This is a genuine but moderate-severity stored XSS (CWE-79) that is deliberately bounded by multiple real-world constraints rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4 Medium) aligns well with the description: network-reachable but requiring an authenticated actor who can add a chapter to a study (PR:L) and requiring a victim to open the malicious study (UI:R). The scope change (S:C) correctly reflects that the injected content executes in the browser context of other viewers. SSVC reinforces this as mid-tier: Exploitation=poc (code/technique available, not active exploitation), Automatable=no (each attack needs a victim to open a specific study), and Technical Impact=partial - consistent with the C:L/I:L/A:N impact. Critically, the description states the site's Content Security Policy blocks injected JavaScript, so this is HTML/CSS injection enabling content spoofing, redirection to attacker sites, and CSS-based data exposure - NOT full script execution or session hijacking. There is no EPSS score and no KEV listing in the provided data, and the SSVC 'poc' status indicates a known technique but no evidence of in-the-wild use. Net: a legitimate issue worth patching promptly, but the PR:L + UI:R + CSP-limited impact combination makes it a managed-risk item rather than a drop-everything priority.

An attacker with a lichess account that can contribute chapters to a shared study uploads a PGN whose 'Annotator' tag contains crafted HTML/CSS; this is stored as the comment author and rendered verbatim into innerHTML when the node has at least two comments. When other users open the study, the attacker-controlled markup renders in their browsers, spoofing content or linking to an attacker-controlled site. A proof-of-concept technique is referenced via the GitHub advisory (SSVC Exploitation=poc), though CSP prevents the injected payload from running JavaScript.