{"id":"CVE-2024-56510","aliases":["GHSA-x52f-h5g4-8qv5"],"url":"https://o3.security/vulnerability/CVE-2024-56510","summary":"Marp Core allows XSS by improper neutralization of HTML sanitization","details":"Marp Core ([`@marp-team/marp-core`](https://www.npmjs.com/package/@marp-team/marp-core)) from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS)  due to improper neutralization of HTML sanitization.\n\n### Impact\n\nMarp Core includes an HTML sanitizer with allowlist support. In the affected versions, the built-in allowlist is enabled by default. When the allowlist is active, if insufficient HTML comments are included, the sanitizer may fail to properly sanitize HTML content and lead cross-site scripting (XSS).\n\n### Patches\n\nMarp Core [v3.9.1](https://github.com/marp-team/marp-core/releases/tag/v3.9.1) and [v4.0.1](https://github.com/marp-team/marp-core/releases/tag/v4.0.1) have been patched to fix that.\n\n### Workarounds\n\nIf you are unable to update the package immediately, disable all HTML tags by setting `html: false` option in the `Marp` class constructor.\n\n```javascript\nconst marp = new Marp({ html: false })\n```\n\n### References\n\n- [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n- https://github.com/marp-team/marp-core/pull/282\n- https://github.com/marp-team/marp-core/commit/61a1def244d1b6faa8e2c0be97ec0b68cab3ab49\n\n### Credits\n\nThanks to @Ry0taK for finding out this vulnerability.","published":"2024-12-26T20:56:24.743Z","modified":"2026-08-12T03:51:22.682076630Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@marp-team/marp-core","fixedVersion":"3.9.1"},{"ecosystem":"npm","name":"@marp-team/marp-core","fixedVersion":"4.0.1"}],"fix":{"url":"https://github.com/marp-team/marp-core/commit/61a1def244d1b6faa8e2c0be97ec0b68cab3ab49","label":"marp-team/marp-core@61a1def"},"references":[{"type":"WEB","url":"https://github.com/marp-team/marp-core/releases/tag/v3.9.1"},{"type":"WEB","url":"https://github.com/marp-team/marp-core/releases/tag/v4.0.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56510.json"},{"type":"ADVISORY","url":"https://github.com/marp-team/marp-core/security/advisories/GHSA-x52f-h5g4-8qv5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56510"},{"type":"FIX","url":"https://github.com/marp-team/marp-core/commit/61a1def244d1b6faa8e2c0be97ec0b68cab3ab49"},{"type":"FIX","url":"https://github.com/marp-team/marp-core/pull/282"},{"type":"PACKAGE","url":"https://github.com/marp-team/marp-core"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:22.682076630Z"}}