CVE-2026-41591: Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-08 · updated 2026-08-26
Weakness: CWE-79

Description

Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.

Affected products

Openjsf Marko: before 5.38.36 — fixed in 5.38.36
Openjsf Marko/Runtime-Tags: before 6.0.164 — fixed in 6.0.164

How to fix

Upgrade to a fixed version: Openjsf Marko 5.38.36; Openjsf Marko/Runtime-Tags 6.0.164. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41591 or the next vulnerability affects your stack