Vulnerability · Published May 8, 2026 · Assigned by GitHub_M
CVE-2026-41591Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
Medium 6.4
In plain English
A medium-severity cross-site scripting in marko from marko-js. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @marko/runtime-tags | 6.0.164 | GHSA-x9fj-57fh-c8wq |
| npm | marko | 5.38.36 | GHSA-x9fj-57fh-c8wq |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
References
- https://github.com/marko-js/marko/security/advisories/GHSA-x9fj-57fh-c8wq x_refsource_CONFIRM