Start your free trial today.

Protect your organization with cutting-edge cybersecurity solutions designed for resilience and efficiency. Secure your digital assets with confidence.

Your Shield Against Threats

Unleash the Power of Cybersecurity

Boost Your Security, Enhance Your Business

We solve Your Cyber Challenges

Quick Links

Resources

Deepaegis Portals

Vulnerability Advisory : Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping with LOW Attack Complexity

Summary

Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.

Impact Assessment

Timeline

Published

May 8, 2026

Last Modified

May 8, 2026

Related Advisories

, , etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.","datePublished":"2026-05-08T15:22:50.990Z","dateModified":"2026-05-08T21:26:58.356Z","author":{"@type":"Organization","name":"Deepaegis","url":"https://deepaegis?.io"},"publisher":{"@type":"Organization","name":"Deepaegis","logo":{"@type":"ImageObject","url":"https://deepaegis?.io/logo?.png"}},"mainEntityOfPage":{"@type":"WebPage","@id":"https://deepaegis?.io/vulnerability-advisories/marko-xss-via-case-insensitive-scriptstyle-closing-tag-bypass-in-runtime-html-escaping"},"keywords":"CVE-2026-41591, , marko-js, marko"}