Gratipay: Markdown parsing issue enables insertion of malicious tags

Markdown tags and event handlers can be used to load malicious URLs in user's profile statement. Here is the payload that when entered in user's profile statement leads to the following HTML: Payload: www.attacker.com/malicious.exe Resulting HTML: "html": "www.attacker.com/malicious.exe\n" See th...