CVE-2026-35208 — lichess.org is the forever free, adless and open source chess server. Any…
Image via opengraph.githubassets.com
🚨 CVE-2026-35208 lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live streams” widget by placing markup in their Twitch/YouTube stream title. CSP is present and blocks inline script execution, but
What This Means For You
- New vulnerability disclosed — verify if your stack is exposed.
- New tool or resource available — evaluate for your security workflow.
Related ATT&CK Techniques
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-35208 | HTML Injection | lichess.org: Arbitrary HTML injection into /streamer and homepage 'Live streams' widget via Twitch/YouTube stream title. Vulnerable component: Streamer profile processing. Fixed by commit 0d5002696ae705e1888bf77de107c73de57bb1b3. |
| CVE-2026-35208 | Server-Side Injection | lichess.org: Server-side HTML injection sink in streamer stream titles. Affects: Approved streamers. Triggered by placing markup in Twitch/YouTube stream titles. |
Source & Attribution
| Source Platform | Telegram |
| Channel | CVE Notify |
| Published | April 07, 2026 at 00:26 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
Ubiquiti Patches Three Max Severity UniFi OS Vulnerabilities
Ubiquiti has rolled out critical security updates addressing three maximum severity vulnerabilities in UniFi OS. BleepingComputer reports these flaws, tracked as CVE-2023-48092, CVE-2023-48093, and CVE-2023-48094,...
Megalodon GitHub Attack: 5,561 Repos Hit with Malicious CI/CD Workflows
The Hacker News reports a new automated campaign, dubbed Megalodon, that injected 5,718 malicious commits into 5,561 GitHub repositories within a mere six-hour window. This...
WordPress Ditty Plugin: Authorization Bypass Exposes Non-Public Content
CVE-2026-9011 — The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and...