CVE-2025-48051

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-48051
powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/lichess-org/lila/blob/7b82f35d15f9113ac8a0a9271d34bef4f6119e9f/ui/site/src/powertip.ts#L60 Product
https://github.com/lichess-org/lila/commit/ab0beaf0ad671761705d9274663c5dc450608527 Patch
https://github.com/lichess-org/lila/security/advisories/GHSA-9xhx-p3c5-p4v6 Exploit Vendor Advisory
https://github.com/lichess-org/lila/security/advisories/GHSA-9xhx-p3c5-p4v6 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lichess:powertip.ts:*:*:*:*:*:*:*:*
History

12 Jun 2025, 13:08

Type Values Removed Values Added
References () https://github.com/lichess-org/lila/blob/7b82f35d15f9113ac8a0a9271d34bef4f6119e9f/ui/site/src/powertip.ts#L60 - () https://github.com/lichess-org/lila/blob/7b82f35d15f9113ac8a0a9271d34bef4f6119e9f/ui/site/src/powertip.ts#L60 - Product
References () https://github.com/lichess-org/lila/commit/ab0beaf0ad671761705d9274663c5dc450608527 - () https://github.com/lichess-org/lila/commit/ab0beaf0ad671761705d9274663c5dc450608527 - Patch
References () https://github.com/lichess-org/lila/security/advisories/GHSA-9xhx-p3c5-p4v6 - () https://github.com/lichess-org/lila/security/advisories/GHSA-9xhx-p3c5-p4v6 - Exploit, Vendor Advisory
CPE cpe:2.3:a:lichess:powertip.ts:*:*:*:*:*:*:*:*
First Time Lichess powertip.ts
Lichess

16 May 2025, 14:43

Type Values Removed Values Added
Summary
  • (es) powertip.ts en Lila (para Lichess) antes de ab0beaf permite XSS en algunas aplicaciones debido a un patrón de uso innerHTML en el que el texto se extrae de un nodo DOM y se interpreta como HTML.

15 May 2025, 20:16

Type Values Removed Values Added
References () https://github.com/lichess-org/lila/security/advisories/GHSA-9xhx-p3c5-p4v6 - () https://github.com/lichess-org/lila/security/advisories/GHSA-9xhx-p3c5-p4v6 -

15 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-15 16:15

Updated : 2025-06-12 13:08

NVD link : CVE-2025-48051

Mitre link : CVE-2025-48051

CVE.ORG link : CVE-2025-48051

JSON object : View

Products Affected

lichess

  • powertip.ts
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')