CVE-2026-35208
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Lichess.org before commit 0d5002696ae705e1888bf77de107c73de57bb1b3 contains a server-side HTML injection vulnerability. Approved streamers can inject arbitrary HTML into their Twitch/YouTube stream title, which is rendered on the streamer page and the 'Live streams' widget on the homepage.
Risk Assessment
An attacker can inject malicious HTML, potentially leading to phishing attacks or page defacement, although CSP blocks inline script execution.
Recommendation
Update Lichess to a version containing commit 0d5002696ae705e1888bf77de107c73de57bb1b3, which fixes this vulnerability.
Original NVD description (English source)
lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live streams” widget by placing markup in their Twitch/YouTube stream title. CSP is present and blocks inline script execution, but the issue is still a server-side HTML injection sink. To trigger this, a Lichess account only needs to satisfy the normal streamer requirements and get approved. Per Streamer.canApply, that means an account older than 2 days with at least 15 games, or a verified/titled account. After moderator approval, once the streamer goes live, Lichess pulls the platform title and renders it into the UI as-is. No extra privileges are needed beyond a normal approved streamer profile. This vulnerability is fixed with commit 0d5002696ae705e1888bf77de107c73de57bb1b3.