Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - marko

Description

When dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc.

Recommendation

Update the marko package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.38.36
• Patched version(s): 5.38.36

References

• GHSA-x9fj-57fh-c8wq
• CVE-2026-41591
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - CVE-2026-41591
• LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS - CVE-2026-44644
• Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
• Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier - CVE-2026-58263

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

CSRF, XXE, and 12 Other Security Acronyms Explained

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Tags:

npm

marko