Medium 5.4Published Apr 6, 2026

CVE-2026-35208lichess.org is the forever free, adless and open source chess server.

Updated under an hour ago (2026-10-19 06:25 UTC)

Does this affect you?

It affects lichess lila. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for lichess lila

Exploited in the last 30 days

lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live streams” widget by placing markup in their Twitch/YouTube stream title. CSP is present and blocks inline script execution, but the issue is still a server-side HTML injection sink. To trigger this, a Lichess account only needs to satisfy the normal streamer requirements and get approved. Per Streamer.canApply, that means an account older than 2 days with at least 15 games, or a verified/titled account. After moderator approval, once the streamer goes live, Lichess pulls the platform title and renders it into the UI as-is. No extra privileges are needed beyond a normal approved streamer profile. This vulnerability is fixed with commit 0d5002696ae705e1888bf77de107c73de57bb1b3.

CVSS: 5.4 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79, CWE-116
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Jul 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

lichess lila lichess:lila	before 2026-03-31	NVD

References

https://github.com/lichess-org/lila/commit/0d5002696ae705e1888bf77de107c73de57bb1b3patch
https://github.com/lichess-org/lila/security/advisories/GHSA-v7gh-939r-pfjqexploit, vendor-advisory
https://vimeo.com/1175908262exploit

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.