# How I Got $10,000 From GitHub For Bypassing Filtration of HTML tags

MathJax integration in GitHub Markdown allowed HTML tag injection via backslash-prefixed filtered tags and entity-encoded tags in curly braces, enabling CSS/UI spoofing.

- Payout: $10,000
- Severity: medium
- Program: GitHub
- Credited: Saajan Bhujel
- Disclosed: 2022-10-16
- Write-up quality: 7/10
- Original: https://saajan.bhujel.cyou/blog/web/2022-10-16-how-i-got-10000-from-github-for-bypassing-filtration-of-html-tags
- Library page: https://bugbountylibrary.com/r/blog%3Asaajan-bhujel-cyou-blog-web-2022-10-16-how-i-got-10000-from-github-for-bypassing-filtration-of-html-tags
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium technique:fuzzing technique:incomplete-fix technique:parser-differential vuln:misconfiguration vuln:xss

**Target:** GitHub Markdown rendering / MathJax math expressions
**Root cause:** MathJax TeX parsing of \<tag> and \<script>{&lt;tag&gt;} sequences rendered attacker HTML tags that GitHub's Markdown sanitizer failed to filter, since filtering only stripped the leading tag but not entity-encoded tags inside braces.
**Steps:**
1. Create a Markdown file in a repo with math delimiters `$$...$$`.
2. First bypass: `$$\<style>*{display:none}</style>{}$$` renders a style tag.
3. After fix, second bypass: `$$<tag style="property:value"></tag>{}$$` allows style attributes and tags like `<input>`, `<button>`.
4. Third bypass: `$$\<script>{&lt;input&gt;<!--}$$` — leading `<script>` is filtered, entity-encoded tag inside `{}` renders.
**How found:** Read GitHub's tweet announcing MathJax support, looked up known MathJax XSS CVEs (<2.7.4), found GitHub patched, then fuzzed delimiter/backslash/entity encodings to find sanitizer gaps; iterated after each fix by changing payload position from `\<tag>{}` to `\{<tag>}` to `\<script>{&lt;tag&gt;}`.
**Exploitation:** Attacker-controlled Markdown renders arbitrary HTML/CSS in the GitHub page context, enabling a fake login form (username/password inputs, styled to mimic GitHub sign-in) to phish credentials from viewers of the rendered file.
**Escalation:** Escalated from basic tag rendering to full-page CSS control and then to a credential-phishing login form overlay; could not escalate to script execution.
**Insight:** When a sanitizer strips a leading dangerous tag, try placing the desired tag entity-encoded inside a delimiter the parser still processes (e.g. MathJax `{}`), and probe backslash-escaped tag sequences — the filter and renderer disagree on what is markup.