When markdown is being presented as HTML, there seems to be a strange interaction between _ and @ that lets an attacker insert malicious tags. # Proof of Concept : ``` hello ``` is rendered converted to the following HTML: ``` /http:hello ``` As you can see, the output...
![Markdown parsing issue enables insertion of malicious tags and event handlers - HackerOne](https://cdn-ak-scissors.b.st-hatena.com/image/square/601e33da6513a188f8b95f6447fd51bb6d910f85/height=288;version=1;width=512/https%3A%2F%2Fprofile-photos.hackerone-user-content.com%2Fvariants%2F000%2F000%2F013%2Ffa942b9b1cbf4faf37482bf68458e1195aab9c02_original.png%2F60f411638706d89ae3052af6fe8b88fa9a798e291deee40f6a22e81418d78d5f)