CVE-2026-41591Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
Updated under an hour ago ()
Does this affect you?
It affects marko-js marko and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.
- CVSS
- 6.4 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness (CWE)
- CWE-79
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- May 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
marko-js marko marko_js:marko (from the name) | marko < 5.38.36; @marko/runtime-tags < 6.0.164 | CNA record |
openjsf marko openjsf:marko | before 5.38.36 | NVD |
openjsf marko/runtime-tags openjsf:marko/runtime-tags | before 6.0.164 | NVD |
References
- https://github.com/marko-js/marko/security/advisories/GHSA-x9fj-57fh-c8wqx-refsource-confirm, exploit, mitigation, patch, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.