# Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered

Backslash-escaped characters inside HackerOne's <url> autolink syntax were unescaped into raw HTML, allowing arbitrary HTML/CSS injection and XSS in browsers lacking CSP support.

- Payout: $5,000
- Severity: high
- Program: HackerOne
- Credited: danlec
- Disclosed: 2015-02-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/46072
- Library page: https://bugbountylibrary.com/r/h1%3A46072
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:high technique:parser-differential vuln:xss

**Target:** Markdown autolink renderer (<http://...> style links)
**Root cause:** The autolink parser stripped backslash escapes and emitted the inner content as raw HTML rather than escaping it, so `<http://\<h1\>test\</h1\>>` rendered literal `<h1>` tags.
**Steps:**
1. Submit markdown containing `<http://\<h1\>test\</h1\>>`
2. Observe rendered output is `http://<h1>test</h1>` with live HTML
3. Inject `<http://\<img\ style="display:none"\ src=0\ onerror="alert('Uh\ oh')"\>>`
4. View submission in IE11 (weak CSP) to trigger alert
**How found:** Researcher tested how backslash escapes inside `<...>` autolink syntax were handled and noticed the escaped angle brackets were rendered as real HTML tags.
**Exploitation:** Attacker posts a submission containing escaped HTML inside an autolink; victims viewing it get injected HTML/CSS. In CSP-weak browsers (IE11) an img onerror executes script; CSS can overlay a full-page phishing link bypassing the redirect warning.
**Escalation:** Chained HTML injection with CSS overlay to cover the submission area for phishing, and onerror handler for script execution where CSP is absent.
**Insight:** Test markdown autolink/URL parsers with backslash-escaped angle brackets and quotes; escape-stripping in link renderers often re-emits content as raw HTML, bypassing sanitizers that only guard normal markdown.