EUVD-2026-19476Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live streams” widget by placing markup in their Twitch/YouTube stream title. CSP is present and blocks inline script execution, but the issue is still a server-side HTML injection sink. To trigger this, a Lichess account only needs to satisfy the normal streamer requirements and get approved. Per Streamer.canApply, that means an account older than 2 days with at least 15 games, or a verified/titled account. After moderator approval, once the streamer goes live, Lichess pulls the platform title and renders it into the UI as-is. No extra privileges are needed beyond a normal approved streamer profile. This vulnerability is fixed with commit 0d5002696ae705e1888bf77de107c73de57bb1b3.
AnalysisAI
Stored HTML injection in lichess.org allows approved streamers to inject arbitrary markup into the /streamer page and homepage 'Live streams' widget via their Twitch or YouTube stream title, enabling defacement and phishing attacks. The vulnerability requires an attacker to first obtain an approved streamer account (accounts older than 2 days with 15+ games, or verified accounts) and then moderate approval, but no additional privileges or authentication beyond that approval is needed. Content Security Policy blocks inline script execution, limiting the immediate scope to HTML/CSS-based attacks rather than arbitrary JavaScript execution. A upstream fix is available via commit 0d5002696ae705e1888bf77de107c73de57bb1b3, and no public exploit code or active exploitation has been reported.
Technical ContextAI
The vulnerability is a stored HTML injection (CWE-79) affecting the Lila chess server application (cpe:2.3:a:lichess-org:lila). Lichess automatically fetches and renders stream titles from external platforms (Twitch and YouTube) into dynamically generated HTML without proper sanitization or encoding. When a streamer goes live, the platform title is inserted directly into the DOM on both the dedicated /streamer page and the homepage widget that displays active streams. Although a Content Security Policy is deployed to prevent inline script execution (blocking <script> tags and event handlers), the absence of output encoding or HTML sanitization leaves the injection point vulnerable to structural HTML attacks such as tag injection, attribute manipulation, and CSS-based visual spoofing. The attack surface is accessible to any account that meets the baseline streamer requirements and passes moderator review-a process designed for community trust but not for validating untrusted external input.
RemediationAI
Immediately update Lila to a version that includes commit 0d5002696ae705e1888bf77de107c73de57bb1b3 or later. For the official lichess.org instance, this fix should have been deployed automatically upon commit merge. For self-hosted Lila deployments, pull the latest main branch or fetch the specific patched commit from the upstream repository (https://github.com/lichess-org/lila). The fix implements output encoding or HTML sanitization of stream titles prior to DOM insertion, neutralizing the injection vector. No workarounds are available short of disabling the live streams widget entirely or restricting streamer accounts; patches must be applied. Administrators should also review recent stream title history for any injected content and, if found, investigate for secondary attacks (phishing, malware distribution) against users who viewed the compromised pages. Refer to the GitHub security advisory (https://github.com/lichess-org/lila/security/advisories/GHSA-v7gh-939r-pfjq) and commit details (https://github.com/lichess-org/lila/commit/0d5002696ae705e1888bf77de107c73de57bb1b3) for implementation details.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today