Unverified60% confidenceFactExact time
Allowing users to submit rich text content containing HTML markup can lead to XSS (Cross-Site Scripting) attacks, where malicious users can inject script tags to execute arbitrary JavaScript code.
2
Sources
60%
Confidence
Long-term
Relevance
8/17/2026
First Seen
Sources
Post Formatter：社交媒体粘贴不丢格式的排版神器
Related Claims
UnverifiedMarkdown 解析器渲染 HTML 时的主要安全威胁是跨站脚本攻击（XSS），因标准 Markdown 允许内嵌原生 HTML77% similarUnverifiedXSS (Cross-Site Scripting) is when a page renders user input directly as HTML, causing malicious scripts to execute in other people's browsers; it is divided into reflected, stored, and DOM types.76% similarUnverifiedA script tag refers to loading external JavaScript into an HTML page via <script src="..."></script>, which the browser loads and executes to dynamically render UI elements72% similarUnverified无JS页面天然规避了跨站脚本（XSS）攻击面，在安全敏感的内容展示场景下是有意义的架构选择71% similarUnverifiedXSS 防护主流方案包括输出净化（DOMPurify、sanitize-html）、沙箱隔离（iframe sandbox、Web Workers）和从源头禁用原始 HTML 内嵌70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/762742API
curl https://kongchang.com/api/v1/knowledge/claims/762742MCP
get_claim(id=762742)