The vulnerability arises when a user who can add a chapter to a lichess study places attacker‑controlled text in the PGN Annotator tag. This text is stored as Comment.Author.External and later returned verbatim by authorText. When a study node contains at least two comments, the web client interpolates that author string directly into innerHTML without escaping, allowing arbitrary HTML and CSS to be rendered for all viewers. Because the site’s content‑security‑policy blocks JavaScript, the attacker cannot execute scripts, but can still perform navigation to malicious sites, spoof legitimate content, and leak data through CSS.

Affected systems include all instances of Lichess.org running versions of the Lila backend before the patch commit c54596c9e1569d378fe20f80d4c790c6fdee54c4. The issue was fixed by that commit. Users and administrators should verify that their instance is at or above that revision or have applied the equivalent security update.

The CVSS score of 5.4 classifies this as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker needs only the permission to create a chapter in a study, a privilege normally granted to normal users. Exploitation can occur locally on the site; once a chapter is added, any subsequent viewer of the study will be exposed to the injected HTML and CSS. The lack of executable JavaScript reduces the impact compared to a full XSS, but still poses a risk of phishing, spoofing, and data exfiltration via CSS.