Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style> tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a <script> or <style> block could break out of the tag with </SCRIPT>, </Style>, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting. This issue has been patched in marko version 5.38.36 and @marko/runtime-tags 6.0.164.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-26 | 1 | Disclosure1 |
| 2026-05-08 | 2 | Disclosure1Patch1 |
| 2026-05-30 | 1 | Disclosure1 |
Found and Disclosed my first CVE (CVE-2026-41591) Rather Small but happy to get the ball rolling Huge Thanks to my mentors at @teambi0s as well as @dylan_piercey for the smooth disclosure process https://github.com/advisories/GHSA-x9fj-57fh-c8wq
Post summary
The user announced the discovery and disclosure of a new CVE (CVE‑2026‑41591) and thanked mentors for the disclosure process.
Proud to share that our Web Team Lead, @k0w4lzk1, has been credited with two CVEs: • CVE-2026-35228: SQL Injection in Oracle's MCP Server Helper Tool • CVE-2026-41591: XSS in eBay's Marko framework Congrats to Kartik on the disclosures!
Post summary
The post celebrates the discovery of two new CVEs—a SQL injection in Oracle's MCP Server Helper Tool and an XSS in eBay's Marko framework—without providing PoC, exploitation details, or patch information.
CVE-2026-41591 Cross-Site Scripting via Tag Breakout in Marko Below 5.38.36 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41591
Post summary
The text is a brief disclosure of CVE-2026-41591, describing an XSS flaw via tag breakout in Marko versions below 5.38.36, with a link to additional details but no PoC, exploit, or patch information.
CVE-2026-41591 Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is inter… https://www.cve.org/CVERecord?id=CVE-2026-41591
Post summary
The post highlights that CVE-2026-41591 is corrected by upgrading to Marko 5.38.36 or @marko/runtime-tags 6.0.164, but provides no detailed technical description or evidence of exploitation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openjsf | marko | - | node.js | - |
| App | openjsf | marko\/runtime-tags | - | node.js | - |