# Markdown parsing issue enables insertion of malicious tags and event handlers

Markdown renderer's mishandling of `_` and `@` in autolinks let attackers inject arbitrary HTML tags with event handlers, enabling XSS.

- Payout: $5,000
- Severity: high
- Program: HackerOne
- Credited: danlec
- Disclosed: 2015-04-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/46916
- Library page: https://bugbountylibrary.com/r/h1%3A46916
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:high tech:rest technique:parser-differential vuln:xss

**Target:** Markdown-to-HTML renderer
**Root cause:** The markdown parser mis-tokenizes `_http://danlec_@.1` — the underscore/at-sign interaction causes the URL autolink parser to emit an unterminated `<u>` and a bogus `<danlec_@.1` tag, letting attacker-controlled text become raw HTML attributes.
**Steps:**
1. Submit markdown `_http://danlec_@.1 foo=bar`
2. Observe rendered HTML `<p><u><a title="http://danlec" href="http://danlec">http://danlec<danlec_@.1 foo=bar</p>`
3. Inject attributes: `_http://danlec_@.1 style=...;display:block;width:100%;height:100px; onclick=alert(unescape(/Oh%20No!/.source));return(false);//`
4. Victim clicks the rendered element in a browser without CSP (e.g. IE11) to execute script
**How found:** Researcher noticed a strange interaction between `_` and `@` when markdown is rendered to HTML, then tested the autolink edge case to see what tags the parser emitted.
**Exploitation:** Attacker crafts markdown that renders a styled block element with an onclick handler disguised as an image/link; victim click executes JS in the page origin.
**Insight:** Probe markdown autolink/emphasis parsers with adversarial punctuation combos (`_`, `@`, `.`) — malformed tokenization can leak attacker text into raw HTML tag/attribute context.