Executive brief
Lichess, a popular open-source chess server, was found to have a vulnerability where approved streamers could inject malicious HTML code into the site's homepage and streamer directory. By changing their stream title on platforms like Twitch or YouTube, a streamer could force visitors to be redirected to external websites or display deceptive content. While the site's security policies blocked direct script execution, the flaw still allowed for phishing-style attacks and service disruption for users viewing the live stream widgets.
Technical details
A server-side HTML injection vulnerability exists in the Lichess 'lila' engine due to improper neutralization of external stream titles. The application fetches stream titles from the Twitch and YouTube APIs and treats them as raw HTML (using the Scalatags 'Html' type) without sufficient escaping or sanitization. An attacker with an approved streamer account (requiring a 2-day old account and 15 games played) can set a malicious title on their streaming platform. When Lichess pulls this title, it is rendered directly into the DOM of the homepage 'Live streams' widget and the /streamer directory. Although a strict Content Security Policy (CSP) prevents inline script execution (XSS), the injection allows for meta-refresh redirects, UI redressing, and phishing via existing frontend gadgets. The issue was fixed by ensuring external titles are treated as plain text rather than HTML.
Affected products
- lichess-org lila versions before commit 0d5002696ae705e1888bf77de107c73de57bb1b3
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-06: disclosed: CVE-2026-35208 published
- 2026-04-06: patched: Fix committed to lila repository