Stored HTML and CSS Injection in Lichess.org by Attacker-Controlled Input

CVE-2026-103974

What is CVE-2026-103974?

Lichess.org, the open-source chess server, was found to have a vulnerability that permits an attacker to inject malicious HTML and CSS into user comments within study nodes. When a participant adds a chapter, they can introduce attacker-controlled content in the PGN Annotator tag. This content is then rendered by the system, allowing the display of harmful HTML and CSS without proper sanitization. Although the site employs a content security policy that mitigates JavaScript injections, the vulnerability still facilitates content spoofing and navigation to malicious sites, presenting a risk to users browsing affected studies. This issue has been rectified in a recent commit.

References