npm/marko CVE-2026-41591: medium 6.4, EPSS 0.27%

Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping

Action: Upgrade marko to 5.38.36 or later.

npm i marko@5.38.36

Affected

Fixed versions

Sources

• osv: GHSA-x9fj-57fh-c8wq
• https://github.com/marko-js/marko/security/advisories/GHSA-x9fj-57fh-c8wq
• https://nvd.nist.gov/vuln/detail/CVE-2026-41591
• https://github.com/marko-js/marko

CVE-2026-41591 · published 2026-04-22T19:55:51Z · modified 2026-05-13T13:54:56.772894Z · JSON