CVE-2026-103974

Deferred Deferred - Pending Action

Stored XSS in Lichess Study Comments via PGN Annotator Tag

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by authorText. When a study node has at least two comments, ui/analyse/src/treeView/inlineView.ts interpolates that author string into HTML passed to the innerHTML hook without escaping it. Opening the affected study can therefore render stored attacker-controlled HTML and CSS for other viewers, including navigation to an attacker-controlled site, content spoofing, and CSS-based data exposure, although the site's content security policy blocks injected JavaScript. This vulnerability is fixed by commit c54596c9e1569d378fe20f80d4c790c6fdee54c4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103974

EUVD

EUVD-2026-101591

Affected Vendors & Products

Vendor	Product	Version / Range
lichess-org	lila	< c54596c9e1569d378fe20f80d4c790c6fdee54c4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored HTML injection vulnerability in the Lichess chess platform. A user with permission to add a chapter to a study can inject attacker-controlled text into the PGN Annotator tag. This text is later rendered as HTML without proper escaping, allowing the attacker to inject malicious HTML or CSS into the page viewed by other users. The vulnerability was fixed by adding HTML escaping to sanitize the author name before rendering.

The issue occurs because the annotator value is processed as raw text and interpolated into HTML strings without sanitization, enabling stored cross-site scripting (XSS) attacks mitigated only by the site's Content Security Policy (CSP).

Detection Guidance

Check for studies with chapters containing PGN Annotator tags with HTML or script content. Inspect the ui/analyse/src/treeView/inlineView.ts file for unsanitized author text interpolation. Review server logs for studies with unusual comments or navigation events.

Impact Analysis

An attacker could redirect you to a malicious website using a meta refresh tag or alter the page's appearance through CSS injection.
Your data could be exposed through CSS-based exfiltration techniques, even though JavaScript execution is blocked by CSP.
Content spoofing may trick you into believing false information is legitimate, potentially leading to misinformed decisions.

Compliance Impact

This vulnerability could lead to violations of GDPR by exposing user data through CSS exfiltration or unauthorized redirects. For HIPAA, it may compromise the confidentiality of user information if sensitive data is exposed via injected CSS or spoofed content.

Mitigation Strategies

Update to the patched commit c54596c9e1569d378fe20f80d4c790c6fdee54c4. Ensure all user-generated content in studies is reviewed for malicious HTML. Monitor for studies with injected meta tags or CSS-based exfiltration attempts.

Hi! I’m here to help you understand CVE-2026-103974. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70