Lichess.org renders third‑party stream titles directly into the page without sanitisation, creating a data sink that can be abused for cross‑site scripting. The flaw is a server‑side injection weakness (CWE‑116) and also an XSS vulnerability (CWE‑79). A streamer with a normal approved account can craft a stream title containing malicious markup; that title then appears unchanged on the streamer page and in the home‑page live‑streams widget, exposing visitors to unintended content.

The vulnerability exists in the Lila application used by lichess.org. Any account that meets the standard streamer prerequisites—older than two days with at least fifteen games, or a verified or titled account—can enable the injection once the account is approved by a moderator and the streamer starts a live session. The flaw applies to all releases before the patch commit 0d5002696ae705e1888bf77de107c73de57bb1b3.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires only the normal permission to be an approved streamer. The attacker’s payload is a stream title, so no extra system privileges are needed; the impact is confined to users who view the streamer page or the live‑streams widget, but the injected content can prompt phishing or other client‑side abuses.