PatchSiren

lichess-org CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM lichess-org CVE published 2026-10-14

CVE-2026-103974

A stored HTML injection vulnerability exists in lichess.org's PGN Annotator tag within studies. An attacker can inject HTML and CSS, which can be rendered when other users view the study. The site's content security policy blocks injected JavaScript, limiting the potential impact. This issue allows for content spoofing and potential CSS-based data exposure. Defenders should prioritize verifying exposure a [truncated]