CVE-2025-48051

MEDIUM 6.1CVE-2025-48051 · Published 15/05/2025 · updated 17/06/2026

In short

CVE-2025-48051 is a MEDIUM (CVSS 6.1) vulnerability affecting powertip.ts (lichess).
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.4% of all vulnerabilities.
Fix: update to 2025-03-27 or later.

Package	Affected versions	Patched versions
powertip.ts lichess	`< 2025-03-27`	`2025-03-27`

Description

powertip.ts in Lila (for Lichess) before ab0beaf allows XSS in some applications because of an innerHTML usage pattern in which text is extracted from a DOM node and interpreted as HTML.

References

lichess-org/lila · Product
lichess-org/lila commit ab0beaf · Patch
lichess-org/lila security advisory · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free