Marp Core allows XSS by improper neutralization of HTML sanitization

Description

Marp Core (@marp-team/marp-core) from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization.

Recommendation

Update the @marp-team/marp-core package to the latest compatible version. Followings are version details:

• Affected version(s): **= 4.0.0

  >= 3.0.2, <= 3.9.0**

• Patched version(s): **4.0.1

  3.9.1**

References

• GHSA-x52f-h5g4-8qv5
• CVE-2024-56510
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• MathLive's Lack of Escaping of HTML allows for XSS - CVE-2025-29049
• Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS) - CVE-2025-27109
• Froala WYSIWYG editor allows cross-site scripting (XSS) - CVE-2024-51434
• Svelte has a potential mXSS vulnerability due to improper HTML escaping - CVE-2024-45047

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@marp-team/marp-core