CVE-2026-103974 | Lichess Lila Inline View inlineView.ts innerHTML Comment.Author.External cross site scripting

October 14, 2026 Yanac

A vulnerability was found in Lichess Lila. It has been declared as problematic. Affected by this issue is the function innerHTML of the file ui/analyse/src/treeView/inlineView.ts of the component Inline View. The manipulation of the argument Comment.Author.External results in cross site scripting.

This vulnerability is known as CVE-2026-103974. It is possible to launch the attack remotely. No exploit is available.

It is advisable to implement a patch to correct this issue.VulDB Recent EntriesRead More