Expected Findings
- Renderer config sets `sanitize:false` and `html:true`.
- `<script>` and `onerror` attributes are preserved in the output.
- Output is later inserted into other users' feeds.
Markdown Renderer
Markdown HTML Injection
The community markdown renderer keeps `sanitize:false` so embedded HTML, `<script>`, and inline event handlers all reach the page.
CWE-79
Markdown probe
"
}).then(r => r.text()).then(t =>
document.getElementById("md-preview").textContent = t);
Primary Flows
- Render POST markdown with raw HTML
- Renderer config Shows unsafe flags
Signals
Config
marked.setOptions({ html: true, sanitize: false })