  _mdLink(tag) {
    tag.content = tag.match[1];
    tag.attrs.href = escape(tag.match[2]);
    if (tag.match[2].match(/^\w+:/)) tag.attrs.target = '_blank';
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.