Is @marko/runtime-tags safe?

GHSA-x9fj-57fh-c8wq

When dynamic text is interpolated into a or tag the Marko runtime failed to prevent tag breakout when the closing tag used non-lowercase casing. An attacker able to place input inside a or block could break out of the tag with , , etc. and inject arbitrary HTML/JavaScript, resulting in cross-site scripting.

The affected helpers used case-sensitive regular expressions to detect attempts at closing the surrounding tag:

// packages/runtime-tags/src/html/content.ts
const unsafeScriptReg = /`, ``, or `` were not matched by these regexes and passed through the helpers unchanged. A browser rendering the output treats the mixed-case end tag as a valid closing tag, terminating the script or style context, and then parses anything that follows as HTML.

The Marko compiler routes interpolated values inside `` and `` tags through these helpers automatically (see `native-tag.ts:1080-1085`), so application code following the framework's conventions had no way to detect or compensate for the gap.

### PoC

$ const userCode = "alert(1)//";

const data = ${JSON.stringify(userCode)};

Would yield the following:

const data = "alert(1)//";

Which is then parsed in any WHATWG-compliant browser as:

const data = " alert(1)//";

### Impact

Cross-site scripting. Any Marko template that explicitly interpolates untrusted data inside a `` or `` block is affected.

Stored XSS is trivial if the value originates from any persisted user input (username, profile bio, comment body, etc.) that is later embedded in a script tag during rendering. Exploitation yields arbitrary JavaScript execution in the victim's browser, enabling session token theft, account takeover, and arbitrary actions as the victim.

Since the internal `_escape_script` and `_escape_style` helpers are the framework's designated defense against script/style tag breakout, applications following standard Marko patterns had no obvious reason to add a second layer of sanitization.

This does not affect scripts or hydration state serialized by Marko itself — only templates that explicitly interpolate untrusted values inside a  or  tag.

### Patch

Commit `19d4b37d0` — `fix: html script, style, and comment escaping`.

• const unsafeScriptReg = /<\/script/g;
• const unsafeScriptReg = /<\/script/gi;

• const unsafeStyleReg = /<\/style/g;
• const unsafeStyleReg = /<\/style/gi;

The same commit also introduced an `_escape_comment` helper and corresponding `escape-comment-placeholder.js`, hardening HTML comment escaping as a related preventative fix. Test fixtures were added under `escape-script-case`, `escape-style-case`, and `escape-comment`.

### Workarounds

Upgrade to the patched release. As a short-term mitigation on affected versions, pre-sanitize any untrusted data before it reaches a template position rendered inside a `` or `` tag — e.g. normalize `</script`, `</style`, and their mixed-case variants before interpolation, or avoid direct interpolation of untrusted values inside these tags entirely.