Medium severity5.3OSV Advisory· Published Dec 26, 2024· Updated Jun 17, 2026
CVE-2024-56510
CVE-2024-56510
Description
@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patched to fix that. If you are unable to update the package immediately, disable all HTML tags by setting html: false option in the Marp class constructor.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@marp-team/marp-corenpm | >= 3.0.2, < 3.9.1 | 3.9.1 |
@marp-team/marp-corenpm | >= 4.0.0, < 4.0.1 | 4.0.1 |
Affected products
2Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-x52f-h5g4-8qv5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-56510ghsaADVISORY
- github.com/marp-team/marp-core/commit/61a1def244d1b6faa8e2c0be97ec0b68cab3ab49nvdWEB
- github.com/marp-team/marp-core/pull/282nvdWEB
- github.com/marp-team/marp-core/releases/tag/v3.9.1nvdWEB
- github.com/marp-team/marp-core/releases/tag/v4.0.1nvdWEB
- github.com/marp-team/marp-core/security/advisories/GHSA-x52f-h5g4-8qv5nvdWEB
News mentions
0No linked articles in our index yet.