CVE-2026-35208

OVERVIEW CVE-2026-35208 is a server-side HTML injection vulnerability in lichess.org, the open-source chess platform. Approved streamers can inject arbitrary HTML code into their stream titles on the platform's /streamer page and the homepage "Live streams" widget by modifying their Twitch or YouTube stream titles. While Content Security Policy blocks inline script execution, the unsanitized HTML injection remains a valid attack vector for defacement and other malicious purposes. SEVERITY The vulnerability is rated CVSS 5.4 MEDIUM with a network-based attack vector requiring low complexity and low privilege requirements. However, exploitation does require user interaction and a moderator-approved streamer account (requiring an account older than 2 days with 15+ games or a verified/titled account). The attack scope is changed, with potential impacts limited to confidentiality and integrity; no availability impact is possible. The FAUCET Risk Score of 32/100 and EPSS score of 0.00034 indicate this is a relatively low-priority vulnerability compared to the broader threat landscape. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from CISA's Known Exploited Vulnerabilities catalog and its inactive status on hot vulnerability lists. No public exploit code has been reported. The vulnerability has been patched through commit 0d5002696ae705e1888bf77de107c73de57bb1b3, and organizations running lichess.org should apply this fix to mitigate the risk.