AGT.25 - Markdown links with a javascript: URL still render as links
2026-09-23T07:59:56.5144722+00:00
claude-code
AGT.25
AGT
Markdown links with a javascript: URL still render as links
(empty)
(empty)
1
Not Started
OPS.12 turned raw HTML off for agent/MCP Markdown, but x passes through Markdig as an href - a separate stored-XSS path. Restrict link schemes to http(s)/mailto/relative (the same rule TPL.11 applied to Url cells).