Medium, CVSS 6.4npmAmendedPublished
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
CVE-2026-41591 · GHSA-x9fj-57fh-c8wq
- Affected
- npm @marko/runtime-tags < 6.0.164
- Fixed in
- 6.0.164· Vendor fix available
- Issue
- When dynamic text is interpolated into a <script or <style tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script or <style block could break out of the tag with </SCRIPT, </Style, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. Details The affected helpers used case-sensitive regular expressions to detect attempts at closing the surrounding tag: HTML tag names are case-insensitive in the browser parser, so inputs such as </SCRIPT, </Script, or </sTyLe were not matched by these regexes and passed through the helpers unchanged. A browser rendering the output treats the mixed-case end tag as a valid closing tag, terminating the script or style context, and then parses anything that follows as HTML. The Marko compiler routes interpolated values inside <script and <style tags through these helpers automatically (see native-tag.ts:1080-1085), so application…
Recommended action: Upgrade to 6.0.164 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.