CVE-2025-48051: XSS
Published May 15, 2025
·Updated
powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML.
Affected Software
2 affected components
Lichess lila<ab0beaf
Lichess powertip.ts<2025-03-27
Remediation
Event History
May 15, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-48051?
CVE-2025-48051 is classified as a moderate severity vulnerability due to the potential for XSS attacks in affected applications.
2
How do I fix CVE-2025-48051?
To fix CVE-2025-48051, update to the Lichess Lila version after ab0beaf to eliminate the vulnerable innerHTML usage.
3
What type of vulnerability is CVE-2025-48051?
CVE-2025-48051 is a Cross-Site Scripting (XSS) vulnerability caused by unsafe handling of HTML content.
4
Which software is affected by CVE-2025-48051?
CVE-2025-48051 affects Lichess Lila versions prior to ab0beaf.
5
What are the potential impacts of CVE-2025-48051?
The potential impacts of CVE-2025-48051 include unauthorized script execution and data exposure from XSS attacks.