HTML Injection Vulnerability in Lichess Chess Server

CVE-2026-35208

What is CVE-2026-35208?

Lichess.org, an open-source chess server, has been found to be vulnerable to HTML injection. Approved streamers can embed arbitrary HTML within their Twitch or YouTube stream titles, which is subsequently injected into the Lichess user interface. Even though Content Security Policy is engaged to prevent inline script execution, the vulnerability still allows for server-side HTML injection. To exploit this vulnerability, a streamer account must meet basic requirements, such as being at least two days old or possessing a verified status. Upon going live, the platform pulls the stream title and renders it directly into the UI without sanitization, posing a security risk. This issue has been addressed in a recent commit to the codebase.

References