CVE-2026-41591

Root

Cause Marko's runtime uses case-sensitive regular expressions (e.g., /</script/g) to detect and prevent attempts to close a <script> or <style> tag when interpolating dynamic text. However, HTML tag names are case-insensitive in browsers. An attacker can bypass the sanitization by using a mixed-case closing tag such as </SCRIPT> or </Style>, which is not matched by the regex but is still interpreted by the browser as a valid closing tag [1][2].

Exploitation

To exploit this, an attacker must be able to place user-controlled input inside a <script> or <style> block within a Marko template. When the template renders the input, the Marko runtime passes it through the flawed sanitization helper. The attacker can include a string like </SCRIPT><script>alert(1)//. The output, when parsed by the browser, treats the mixed-case tag as ending the script context, then parses the subsequent <script> tag as a new script element, executing the injected code [2].

Impact

Successful exploitation leads to cross-site scripting (XSS). If the vulnerable input originates from persisted user data (e.g., username, comment), stored XSS is possible, allowing an attacker to execute arbitrary JavaScript in the context of any victim viewing the affected page [1][2].

Mitigation

The issue is patched in marko version 5.38.36 and @marko/runtime-tags version 6.0.164. Users should upgrade immediately. No workaround is available for earlier versions [1][2].