CVE-2026-103974: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in lichess-org lila

The vulnerability in lichess-org's lila is an improper neutralization of input during web page generation (CWE-79), specifically a stored cross-site scripting issue. A user with permission to add a chapter to a study can insert malicious text into the PGN Annotator tag, which becomes Comment.Author.External and is returned verbatim by authorText. When a study node contains at least two comments, the UI code interpolates this author string directly into HTML via innerHTML without escaping, allowing attacker-controlled HTML and CSS to be rendered in other users' browsers. Although JavaScript injection is blocked by the site's content security policy, the vulnerability still permits navigation to attacker-controlled sites, content spoofing, and CSS-based data exposure. The issue was resolved in commit c54596c9e1569d378fe20f80d4c790c6fdee54c4.

This vulnerability allows an attacker with limited privileges (ability to add a chapter to a study) to inject malicious HTML and CSS that other users will render when viewing the study. This can lead to user redirection to attacker-controlled sites, spoofing of site content, and exposure of data via CSS techniques. The content security policy mitigates JavaScript injection, reducing the risk of more severe attacks such as session hijacking or direct code execution. There is no indication of active exploitation in the wild.

The vulnerability has been fixed by commit c54596c9e1569d378fe20f80d4c790c6fdee54c4. Users and administrators should update to the version including this commit to remediate the issue. No additional mitigations are indicated by the vendor advisory. Patch status is confirmed by the commit reference; no further action is required beyond applying this fix.