npm/@marko/runtime-tags CVE-2026-41591: medium 6.4, EPSS 0.23%
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
Action: Upgrade @marko/runtime-tags to 6.0.164 or later.
npm i @marko/runtime-tags@6.0.164Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.0.164 | - |
Fixed versions
| 6.0.164 |
Sources
- osv: GHSA-x9fj-57fh-c8wq#npm/@marko/runtime-tags
- https://github.com/marko-js/marko/security/advisories/GHSA-x9fj-57fh-c8wq
- https://nvd.nist.gov/vuln/detail/CVE-2026-41591
- https://github.com/marko-js/marko
CVE-2026-41591 · published · modified · JSON