Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103974— lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies

Quick assessment

Affected
lichess-org lila
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

lichess.org 是一个永久免费、无广告且开源的国际象棋服务器。在提交 c54596c9e1569d378fe20f80d4c790c6fdee54c4 之前，具备向研究（study）添加章节（chapter）权限的用户，可以在 PGN 标注器（Annotator）标签中注入由攻击者控制的文本。该文本随后被标识为 Comment.Author.External，并通过 authorText 方法原样返回。当某个研究节点包含至少两条注释时，前端代码 ui/analyse/src/treeView/inlineV

CVSS 5.4 · Medium EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 1

VendorProduct Version RangeStatus
lichess-org lila < c54596c9e1569d378fe20f80d4c790c6fdee54c4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103974

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies
Source: CVE Program / CVE List V5
Vulnerability Description
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by authorText. When a study node has at least two comments, ui/analyse/src/treeView/inlineView.ts interpolates that author string into HTML passed to the innerHTML hook without escaping it. Opening the affected study can therefore render stored attacker-controlled HTML and CSS for other viewers, including navigation to an attacker-controlled site, content spoofing, and CSS-based data exposure, although the site's content security policy blocks injected JavaScript. This vulnerability is fixed by commit c54596c9e1569d378fe20f80d4c790c6fdee54c4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
lichess-org lila < c54596c9e1569d378fe20f80d4c790c6fdee54c4 -

II. Public POCs for CVE-2026-103974

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103974

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-103974 (1)

Other References for CVE-2026-103974 (1)

IV. Related Vulnerabilities

Same product: lila
Same vendor: lichess-org
Same weakness: CWE-79

V. Comments for CVE-2026-103974

No comments yet

Leave a comment