CVE-2026-41591
Description
Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.
How to fix
- openjsf marko5.38.36 or later
- openjsf marko\/runtime-tags6.0.164 or later
- marko5.38.36 or later
- @marko/runtime-tags6.0.164 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openjsf marko | v < 5.38.36 | 5.38.36 |
| openjsf marko\/runtime-tags | v < 6.0.164 | 6.0.164 |
| markonpm | v < 5.38.36 | 5.38.36 |
| @marko/runtime-tagsnpm | v < 6.0.164 | 6.0.164 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.