CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-48051: powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted...
4.7
CVSS
Description
powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML.
Classification
CVE ID: CVE-2025-48051
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.7
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Problem Types
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Affected Products
Vendor: Lichess
Product: Lila
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.03% (probability of being exploited)
EPSS Percentile: 7.19% (scored less or equal to compared to others)
EPSS Date: 2025-06-13 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-48051https://github.com/lichess-org/lila/security/advisories/GHSA-9xhx-p3c5-p4v6
https://github.com/lichess-org/lila/commit/ab0beaf0ad671761705d9274663c5dc450608527
https://github.com/lichess-org/lila/blob/7b82f35d15f9113ac8a0a9271d34bef4f6119e9f/ui/site/src/powertip.ts#L60