SA-2026-003: Article links could inject attributes

What it is

The article renderer escaped text without escaping quotes, then put link targets into href="...". A link target holding a quote could add attributes, such as an event handler.

What an attacker could do

Stored XSS through any article text, including guest articles.

How: [x](/a" onmouseover="...) in an article became a live handler.

Root cause

html.escape(quote=False) was used for text that later landed inside an attribute.

What contributed

• The markdown renderer was hand-written, with regexes, after escaping.

What was not in place

Escaping matched to the output context, and link targets restricted to a safe character set.

The fix

Link targets are quoted, escaped and restricted to [A-Za-z0-9/._#-]; https links exclude quotes and spaces.

What prevents it now

The gate fails on inline event-handler attributes in generated HTML (the check is on the security branch).