GitHub Security Advisory: GHSA-x9fj-57fh-c8wq
Package: marko (NPM)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.38.36
Patched in: 5.38.36

Summary: Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping

Details:
### Summary

When dynamic text is interpolated into a `<script>` or `<style>` tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing.
An attacker able to place input inside a `<script>` or `<style>` block could break out of the tag with `</SCRIPT>`, `</Style>`, etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting.

### Details

The affected helpers used case-sensitive regular expressions to detect attempts at closing the surrounding tag:

```js
// packages/runtime-tags/src/html/content.ts
const unsafeScriptReg = /<\/script/g;
const unsafeStyleReg  = /<\/style/g;

// packages/runtime-class/src/runtime/html/helpers/escape-script-placeholder.js
const unsafeCharsReg = /<\/script/g;

// packages/runtime-class/src/runtime/html/helpers/escape-style-placeholder.js
const unsafeCharsReg = /<\/style/g;
```

HTML tag names are case-insensitive in the browser parser, so inputs such as `</SCRIPT>`, `</Script>`, or `</sTyLe>` were not matched by these regexes and passed through the helpers unchanged. A browser rendering the output treats the mixed-case end tag as a valid closing tag, terminating the script or style context, and then parses anything that follows as HTML.

The Marko compiler routes interpolated values inside `<script>` and `<style>` tags through these helpers automatically (see `native-tag.ts:1080-1085`), so application code following the framework's conventions had no way to detect or compensate for the gap.

### PoC

```marko
$ const userCode = "</SCRIPT><script>alert(1)//";
<script>
  const data = ${JSON.stringify(userCode)};
</script>
```

Would yield the following:

```html
<script>const data = "</SCRIPT><script>alert(1)//";</script>
```

Which is then parsed in any WHATWG-compliant browser as:
```html
<script>const data = "</script>
<script>alert(1)//";</script>
```

### Impact

Cross-site scripting. Any Marko template that explicitly interpolates untrusted data inside a `<script>` or `<style>` block is affected.

Stored XSS is trivial if the value originates from any persisted user input (username, profile bio, comment body, etc.) that is later embedded in a script tag during rendering. Exploitation yields arbitrary JavaScript execution in the victim's browser, enabling session token theft, account takeover, and arbitrary actions as the victim.

Since the internal `_escape_script` and `_escape_style` helpers are the framework's designated defense against script/style tag breakout, applications following standard Marko patterns had no obvious reason to add a second layer of sanitization.

This does not affect scripts or hydration state serialized by Marko itself — only templates that explicitly interpolate untrusted values inside a <script> or <style> tag.

### Patch

Commit `19d4b37d0` — `fix: html script, style, and comment escaping`.

```diff
- const unsafeScriptReg = /<\/script/g;
+ const unsafeScriptReg = /<\/script/gi;

- const unsafeStyleReg  = /<\/style/g;
+ const