xss case about markdown-xss-payloads HOT 3 CLOSED

https://archive.fo/czTWm

from markdown-xss-payloads.

@cujanovic i just confused about [a](j a v a s c r i p t:prompt(document.cookie)), does this is xss case?

from markdown-xss-payloads.

from the blogpost:
"The above vectors target edge cases and a majority of Markdown libraries."
Now I don't understand your question here.
Clearly some Markdown lib was/is vulnerable to this payload.
My guess is that the string " " bypasses the filter that is probably doing some regex or matching for javascript string.

from markdown-xss-payloads.