Marko is a framework for building web applications using an HTML-based template language. The vulnerability resides in the runtime when dynamic content is interpolated into <script> or <style> tags. The escaping logic mistakenly permits a closing tag to be written with mixed or upper‑case letters, such as </SCRIPT> or </Style>, thereby breaking out of the intended tag and allowing the attacker to inject arbitrary HTML or JavaScript. This results in a classic reflected cross‑site scripting flaw that can execute code in the victim’s browser context.

The issue affects installations of the Marko runtime library prior to version 5.38.36 and the @marko/runtime-tags package prior to version 6.0.164. Any web application that renders user data inside <script> or <style> elements without additional safeguards is vulnerable.

The CVSS score of 6.4 indicates a moderate severity, and the vulnerability has not been listed in the CISA KEV catalog. Because the flaw is triggered by normal user-supplied content placed inside script or style blocks, an attacker can exploit it via the application’s public interfaces without requiring elevated privileges. The lack of an EPSS score does not negate the risk; the path to exploitation is straightforward and does not rely on special conditions beyond the presence of vulnerable Marko templates.