` so the reference gsub expands inside the alt/href attribute.
3. Use GollumTagsFilter `[[a|http:'"<]]` to inject `"` into generated href, breaking out of attribute since Sanitize only escapes user-supplied hrefs.
4. Inject `` — Nokogiri HTML4 parses `` as child of style, browser HTML5 mutates it out of svg context.
5. Final payload uses `` to execute JS.
6. Save page; victim viewing wiki triggers alert(document.domain).
**How found:** Noticed link_pattern_start only checks prefix while gsub replaces all occurrences in inner_html; hypothesized attribute expansion inside nested anchors, then explored quote handling in Sanitize vs GollumTagsFilter-generated hrefs, and finally leveraged HTML4/HTML5 parser differential for mXSS.
**Exploitation:** Attacker stores crafted wiki page content; when any user (including privileged) views the page, the Banzai pipeline renders the mutated HTML and the browser executes the injected script under gitlab.com origin, bypassing CSP via the gl-show-field-errors input title trick, enabling arbitrary REST API calls as the victim.
**Escalation:** Chained three primitives: reference gsub attribute injection, GollumTagsFilter href quote injection bypassing Sanitize, and Nokogiri HTML4 vs browser HTML5 mXSS to escape svg/style context.
**Insight:** When a filter re-runs pattern substitution on already-rendered inner_html, nested anchors let reference expansion land inside attributes; also, sanitizer escaping applies only to user input, not to hrefs synthesized by other filters — audit those synthesized attributes for quote injection.