PT-2025-21332 · Lila · Lila

Odaysec · Published 2025-05-15 · Updated 2025-06-12 · CVE-2025-48051

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lila (for Lichess) version before ab0beaf

Description The issue is related to an innerHTML usage pattern in powertip.ts, where text is extracted from a DOM node and interpreted as HTML, allowing Cross-Site Scripting (XSS) in some applications.

Recommendations For versions before ab0beaf, update to a version after ab0beaf to resolve the issue. As a temporary workaround, consider restricting the use of the innerHTML pattern in powertip.ts to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-48051

GHSA-9XHX-P3C5-P4V6

Affected Products

Lila

References · 9

• 🔥 https://github.com/lichess-org/lila/security/advisories/GHSA-9xhx-p3c5-p4v6 · Exploit
• https://github.com/lichess-org/lila/commit/ab0beaf0ad671761705d9274663c5dc450608527 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-48051 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48051 · Vendor Advisory
• https://github.com/lichess-org/lila/blob/7b82f35d15f9113ac8a0a9271d34bef4f6119e9f/ui/site/src/powertip.ts#L60 · Note
• https://t.me/cvetracker/23916 · Telegram Post
• https://t.me/cvenotify/125475 · Telegram Post
• https://twitter.com/dailycve/status/1933162884374159583 · Twitter Post
• https://twitter.com/CVEnew/status/1923057908935246294 · Twitter Post