Your Markdown Parser Is Not Your XSS Boundary

A Markdown parser can produce exactly the right HTML and still leave your application exposed to XSS....