CVE-2026-41591 Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
Attackers can inject arbitrary JavaScript via case-insensitive closing tags in script or style blocks, leading to cross-site scripting.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41591?
CVE-2026-41591 is a medium-severity cross-site scripting vulnerability in marko-js marko, published on 8 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.
Weakness: CWE-79
Which versions are affected by CVE-2026-41591?
4 open source packages ship an affected version, including @marko/runtime-tags and marko. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@marko/runtime-tags npm | All versions | 6.0.164 |
@marko/runtime-tags npm | All versions | 6.0.164 |
marko npm | All versions | 5.38.36 |
marko npm | All versions | 5.38.36 |
Products include Openjsf Marko, Openjsf Marko\/Runtime-Tags.
How do I fix CVE-2026-41591?
Upgrade @marko/runtime-tags to 6.0.164 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-41591 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41591 exists.
Sources
Also known as GHSA-x9fj-57fh-c8wq.