{
  "id": 1851303,
  "title": "Your Markdown Parser Is Not Your XSS Boundary",
  "url": "https://urgent.news/2026/08/19/your-markdown-parser-is-not-your-xss-boundary",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-19T02:36:27.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/mdfold/your-markdown-parser-is-not-your-xss-boundary-2gpk"
  },
  "original_language": "en",
  "account": null,
  "summary": "A Markdown parser can produce exactly the right HTML and still leave your application exposed to XSS. Parsing answers what the input means. Sanitization decides which parts of that meaning are allowed to reach an HTML sink. I tested that boundary with Node.js 25.3.0, Marked 18.0.7, DOMPurify 3.4.12, and jsdom 30.0.1. The important comparison is not a screenshot. It is the HTML before and after…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}