Lichess maintains a focused open-source chess platform whose vulnerability profile centers on web application components including its Lila server and PowerTip.ts tooltip library, with the durable signal concentrated on input-handling and output-encoding weaknesses such as cross-site scripting, improper output escaping, and server-side request forgery. These weakness classes are characteristic of web applications where user input flows through multiple layers and rendering contexts; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Lichess over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-52186MEDIUM Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02) contains a Server-Side Request Forgery (SSRF) vulnerability in the game export API. The players par | Nov 13, 2025 | 6.5 | 22 | NO | NO |
CVE-2026-35208MEDIUM lichess.org is the forever free, adless and open source chess server. Any approved streamer can inject arbitrary HTML into /streamer and the homepage “Live streams” widget by placi | Apr 6, 2026 | 5.4 | 19 | NO | NO |
CVE-2025-48051MEDIUM powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as | May 15, 2025 | 6.1 | 18 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Lichess.
Media articles that mention a CVE ID that affects a product developed by Lichess — matched by CVE ID, not by vendor name.