# Markdown parsing issue enables insertion of malicious tags and event handlers

Markdown link autolinking of `</http:<marquee>` produced unbalanced HTML, letting an attacker inject arbitrary tags and event handlers for stored XSS on hackerone.com.

- Payout: $5,000
- Severity: high
- Program: HackerOne
- Credited: dr_dragon
- Disclosed: 2018-01-29
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/299728
- Library page: https://bugbountylibrary.com/r/h1%3A299728
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:rest technique:parser-differential vuln:xss

**Target:** Markdown-to-HTML renderer (link autolinking)
**Root cause:** The markdown renderer's autolink handling of a `</http:...>` construct emitted a closing tag `</http:<marquee>` outside the anchor, breaking out of the sanitized link context and allowing arbitrary tag/attribute injection.
**Steps:**
1. Submit markdown containing `</http:<marquee>hello`
2. Renderer outputs `<p><a title="/http:<marquee" href="/http:%3Cmarquee" target="_blank">/http:<marquee>hello</p></marquee></a></p>`
3. Observe the stray `</http:<marquee>` closing tag escaping the anchor
4. Add arbitrary attributes/event handlers to the injected tag to execute script
**How found:** Noticed a strange interaction between `_` and `@` in markdown rendering and tested a `</http:...>` construct to see how the autolinker tokenized it, revealing an unbalanced closing tag.
**Exploitation:** Attacker posts crafted markdown in a context rendered to HTML (e.g. comment/report); the malformed autolink output injects a tag with event handlers that fire when other users view the content, yielding stored XSS.
**Insight:** Probe markdown autolinkers with malformed URL-like tokens (`</http:...>`, angle brackets, scheme prefixes) and inspect the raw output HTML for tags escaping the anchor context rather than trusting the sanitized render.