, , etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.","additionalType":"https://schema.org/SoftwareApplication","sameAs":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41591"]},"keywords":"CVE-2026-41591, Medium, CWE-79, Marko Js Marko, Fastify Marko, Fastify Marko\\/runtime Tags","mentions":[{"@type":"SoftwareApplication","name":"Marko","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Marko Js"}},{"@type":"SoftwareApplication","name":"Marko","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Fastify"}},{"@type":"SoftwareApplication","name":"Marko\\/runtime Tags","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Fastify"}}],"isAccessibleForFree":true},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://portal.vyprsec.ai/"},{"@type":"ListItem","position":2,"name":"CVEs","item":"https://portal.vyprsec.ai/cves"},{"@type":"ListItem","position":3,"name":"CVE-2026-41591","item":"https://portal.vyprsec.ai/cves/CVE-2026-41591"}]}]}

Medium severity6.4GHSA Advisory· Published May 8, 2026· Updated Aug 26, 2026

CVE-2026-41591

Description

Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a , , etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
markonpm	< 5.38.36	5.38.36
@marko/runtime-tagsnpm	< 6.0.164	6.0.164

Affected products

Marko Js/MarkoGHSA
Range: < 6.0.164
Fastify/Marko
cpe:2.3:a:openjsf:marko:*:*:*:*:*:node.js:*:*
Range: <5.38.36
Fastify/Marko\/runtime Tags
cpe:2.3:a:openjsf:marko\/runtime-tags:*:*:*:*:*:node.js:*:*
Range: <6.0.164
ghsa-coords2 versions
pkg:npm/%40marko/runtime-tags pkg:npm/marko
< 6.0.164+ 1 more
- (no CPE)range: < 6.0.164
- (no CPE)range: < 5.38.36

Patches

Vulnerability mechanics

References

github.com/marko-js/marko/security/advisories/GHSA-x9fj-57fh-c8wqnvdExploitMitigationPatchVendor AdvisoryWEB
github.com/advisories/GHSA-x9fj-57fh-c8wqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-41591ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000