Marp Core allows XSS by improper neutralization of HTML sanitization
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patched to fix that. If you are unable to update the package immediately, disable all HTML tags by setting html: false option in the Marp class constructor.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| marp-team | marp-core | 3.0.2 to before 3.9.1; 4.0.0 to before 4.0.1 | 3.9.1, 4.0.1 | Patch available | CNA |
| — | @marp-team/marp-core (npm) | 3.0.2 to before 3.9.1 | 3.9.1 | Patch available | GHSA-x52f-h5g4-8qv5 |
| — | @marp-team/marp-core (npm) | 4.0.0 to before 4.0.1 | 4.0.1 | Patch available | GHSA-x52f-h5g4-8qv5 |
- marp-core Vendormarp-team Affected 3.0.2 to before 3.9.1; 4.0.0 to before 4.0.1 Fixed in 3.9.1, 4.0.1 Patch available CNA
- @marp-team/marp-core (npm) Vendor— Affected 3.0.2 to before 3.9.1 Fixed in 3.9.1 Patch available GHSA-x52f-h5g4-8qv5
- @marp-team/marp-core (npm) Vendor— Affected 4.0.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-x52f-h5g4-8qv5
Remediation
- Fix · CNA marp-core (marp-team) Fixed in 3.9.1, 4.0.1
- Fix · GHSA-x52f-h5g4-8qv5 @marp-team/marp-core (npm) Fixed in 3.9.1 Advisory →
- Fix · GHSA-x52f-h5g4-8qv5 @marp-team/marp-core (npm) Fixed in 4.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-56510
- 2026-10-03 Alias added: GHSA-x52f-h5g4-8qv5
References
Other 6
- https://github.com/marp-team/marp-core/security/advisories/GHSA-x52f-h5g4-8qv5
- https://github.com/marp-team/marp-core/pull/282
- https://github.com/marp-team/marp-core/commit/61a1def244d1b6faa8e2c0be97ec0b68cab3ab49
- https://github.com/marp-team/marp-core/releases/tag/v3.9.1
- https://github.com/marp-team/marp-core/releases/tag/v4.0.1
- https://github.com/marp-team/marp-core
Sources
- CVE-2024-56510 · CVE Program
- CVE-2024-56510 · NVD
- FIRST EPSS
- GHSA-x52f-h5g4-8qv5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences