Lichess

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Lichess records in CISA KEV

No Lichess vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Lila 2 records MEDIUM Powertip.ts 1 record MEDIUM

Records

3 records

TI-2025-32501 CVE-2025-52186 · GHSA-85hq-hqhm-3jf2

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains…

MEDIUM 62

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00344 Published 2025-11-13 No fix listed CWE-918

TI-2025-30423 CVE-2025-48051 · GHSA-chv9-fg26-xg8h

Cross-site scripting in Lichess Lila

MEDIUM 60

powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00439 Published 2025-05-15 Fixed CWE-79

TI-2026-27361 CVE-2026-35208

lichess.org has an Unsanitized Stream Title Injection on /streamer

LOW 24

lichess.org is the forever free, adless and open source chess server.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0031 Published 2026-04-06 Fixed in 0d5002696ae705e1888bf77de107c73de57bb1b3 CWE-116

Open these records in search →

Critical	0
High	0
Medium	3
Low	0
No CVSS	0