CVE-2025-48051

Name of the Vulnerable Software and Affected Versions Lila (for Lichess) version before ab0beaf

Description The issue is related to an innerHTML usage pattern in powertip.ts, where text is extracted from a DOM node and interpreted as HTML, allowing Cross-Site Scripting (XSS) in some applications.

Recommendations For versions before ab0beaf, update to a version after ab0beaf to resolve the issue. As a temporary workaround, consider restricting the use of the innerHTML pattern in powertip.ts to minimize the risk of exploitation.