CVE-2026-103974 lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies
Attackers can inject stored HTML and CSS into chess studies, enabling content spoofing and data exposure for other viewers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-103974?
CVE-2026-103974 is a medium-severity cross-site scripting vulnerability in lichess-org lila, published on 14 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by authorText. When a study node has at least two comments, ui/analyse/src/treeView/inlineView.ts interpolates that author string into HTML passed to the innerHTML hook without escaping it. Opening the affected study can therefore render stored attacker-controlled HTML and CSS for other viewers, including navigation to an attacker-controlled site, content spoofing, and CSS-based data exposure, although the site's content security policy blocks injected JavaScript. This vulnerability is fixed by commit c54596c9e1569d378fe20f80d4c790c6fdee54c4.
Weakness: CWE-79
Which versions are affected by CVE-2026-103974?
How do I fix CVE-2026-103974?
No fix has been published for CVE-2026-103974 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-103974 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-103974 exists.
Sources
Also known as GHSA-43g7-r6hp-ccf8.