  _mdIrcColorFormatting(tag) {
    const end = tag.after.indexOf('\x03');
    if (end == -1) return;
    tag.content = tag.after.substring(0, end);
    tag.after = tag.after.substring(end + tag.captured.length);

    const style = [];
    const color = tag.captured.replace(/\x030?(\d{1,2}).*/, '$1');
    if (COLORS[color]) style.push('color:' + COLORS[color]);
    const background = tag.captured.replace(/.*,(\d{1,2}).*/, '$1');
    if (COLORS[background]) style.push('background-color:' + COLORS[background]);
    if (style.length) tag.attrs.style = style.join(';');
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.