CVE-2026-103974 lichess-org CVE debrief

Who should care

Defenders responsible for managing and securing lichess.org installations should assess exposure and apply the vendor's patch. Users who create or view studies on lichess.org may also be impacted.

Why it matters

The stored HTML injection vulnerability in lichess.org's PGN Annotator tag within studies allows attackers to inject HTML and CSS, potentially leading to content spoofing and CSS-based data exposure. Defenders should prioritize verifying exposure and applying the vendor's patch.

• Content spoofing: attackers can inject HTML and CSS, potentially leading to visual tampering or phishing attempts
• CSS-based data exposure: attackers may inject CSS to extract user data or perform other malicious actions
• Defensive priority: verifying exposure and applying the vendor's patch is crucial to prevent potential attacks
• Verification priority: defenders should verify if the PGN Annotator tag is used in studies and if the fix has been applied

Technical summary

The vulnerability exists in the PGN Annotator tag within studies on lichess.org. An attacker can inject HTML and CSS, which can be rendered when other users view the study. The site's content security policy blocks injected JavaScript, limiting the potential impact. The issue is fixed in commit c54596c9e1569d378fe20f80d4c790c6fdee54c4. This allows for content spoofing and potential CSS-based data exposure. Defenders should prioritize verifying exposure and applying the vendor's patch. The fix involves updating to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4 or later.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor's patch, as the vulnerability allows for content spoofing and potential CSS-based data exposure.

Recommended defensive actions

• Verify exposure by checking if the PGN Annotator tag is used in studies
• Apply the vendor's patch by updating to commit c54596c9e1569d378fe20f80d4c790c6fdee54c4 or later
• Monitor for potential content spoofing and CSS-based data exposure
• Review and update content security policies to ensure they are adequate
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed by the CVE Program record and the lichess-org vendor advisory. The issue is fixed in commit c54596c9e1569d378fe20f80d4c790c6fdee54c4. Evidence is limited to CVE Program records and vendor advisories. Defenders should verify if the PGN Annotator tag is used in studies and if the fix has been applied. The CVE record was published on 2026-10-14T18:17:13.770Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.