CVE-2026-41591
2 advisories.
npm/marko CVE-2026-41591: medium 6.4, EPSS 0.27%
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
Action: Upgrade marko to 5.38.36 or later.
npm i marko@5.38.36Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.38.36 | - |
Fixed versions
| 5.38.36 |
Sources
- osv: GHSA-x9fj-57fh-c8wq
- https://github.com/marko-js/marko/security/advisories/GHSA-x9fj-57fh-c8wq
- https://nvd.nist.gov/vuln/detail/CVE-2026-41591
- https://github.com/marko-js/marko
CVE-2026-41591 · published · modified · JSON
npm/@marko/runtime-tags CVE-2026-41591: medium 6.4, EPSS 0.27%
Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
Action: Upgrade @marko/runtime-tags to 6.0.164 or later.
npm i @marko/runtime-tags@6.0.164Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 6.0.164 | - |
Fixed versions
| 6.0.164 |
Sources
- osv: GHSA-x9fj-57fh-c8wq#npm/@marko/runtime-tags
- https://github.com/marko-js/marko/security/advisories/GHSA-x9fj-57fh-c8wq
- https://nvd.nist.gov/vuln/detail/CVE-2026-41591
- https://github.com/marko-js/marko
CVE-2026-41591 · published · modified · JSON