CVE-2026-103974: lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies
lichess.org is the forever free, adless and open source chess server. Prior to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4, a user who can add a chapter to a study can place attacker-controlled text in the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by authorText. When a study node has at least two comments, ui/analyse/src/treeView/inlineView.ts interpolates that author string into HTML passed to the innerHTML hook without escaping it. Opening the affected study can therefore render stored attacker-controlled HTML and CSS for other viewers, including navigation to an attacker-controlled site, content spoofing, and CSS-based data exposure, although the site's content security policy blocks injected JavaScript. This vulnerability is fixed by commit c54596c9e1569d378fe20f80d4c790c6fdee54c4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch c54596c9e1569d378fe20f80d4c790c6fdee54c4
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed?
An attacker needs permission to add a chapter to a study. Viewers who open an affected study can be exposed to the stored HTML and CSS content.
What conditions are required for the injected content to render?
The malicious value must be placed in the PGN Annotator tag of a chapter, and a study node must have at least two comments. The affected study must then be opened by another viewer.
What can an attacker do through the injected content?
The injected HTML and CSS can navigate viewers to an attacker-controlled site, spoof content, and enable CSS-based data exposure. Injected JavaScript is blocked by the site's content security policy.
How can I determine whether the issue has been fixed?
The vulnerability is fixed by commit c54596c9e1569d378fe20f80d4c790c6fdee54c4. Verify that the deployed source includes this commit or its equivalent fix.