CVSS 3.1
6.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NCVE-2026-41591
Medium (6.4) in openjsf. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in marko 5.38.36.
Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openjsf:marko
- openjsf:marko\/runtime-tags
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x9fj-57fh-c8wq | npm | marko | <5.38.36 | 5.38.36 |
| GHSA-x9fj-57fh-c8wq | npm | @marko/runtime-tags | <6.0.164 | 6.0.164 |