Read the docs
TI-2026-27361 Aliases CVE-2026-35208

lichess.org has an Unsanitized Stream Title Injection on /streamer

Priority LOW 24CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live streams” widget by placing markup in their Twitch/YouTube stream title. CSP is present and blocks inline script execution, but the issue is still a server-side HTML injection sink. To trigger this, a Lichess account only needs to satisfy the normal streamer requirements and get approved. Per Streamer.canApply, that means an account older than 2 days with at least 15 games, or a verified/titled account. After moderator approval, once the streamer goes live, Lichess pulls the platform title and renders it into the UI as-is. No extra privileges are needed beyond a normal approved streamer profile. This vulnerability is fixed with commit 0d5002696ae705e1888bf77de107c73de57bb1b3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 24th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed lila (lichess-org): 0d5002696ae705e1888bf77de107c73de57bb1b3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lichess-orglilabefore 0d5002696ae705e1888bf77de107c73de57bb1b30d5002696ae705e1888bf77de107c73de57bb1b3Patch availableCNA
  • lila Vendorlichess-org Affected before 0d5002696ae705e1888bf77de107c73de57bb1b3 Fixed in 0d5002696ae705e1888bf77de107c73de57bb1b3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lichess:lila:*:*:*:*:*:*:*:*before 2026-03-31VulnerableLichess
  • cpe:2.3:a:lichess:lila:*:*:*:*:*:*:*:* Versions before 2026-03-31 Vulnerable ·Lichess

Remediation

  • Fix · CNA lila (lichess-org) Fixed in 0d5002696ae705e1888bf77de107c73de57bb1b3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35208

References

Exploit 2

Patch 1

  • TI-2026-74411 Stored HTML injection in lichess.org study PGN annotator tag CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences