  _mdTag(tag) {
    // Check if the matched character was escaped
    if (tag.before.match(/\\$/)) {
      tag.before = tag.before.replace(/\\$/, '');
      return;
    }

    const end = tag.after.indexOf(tag.captured);
    if (end == -1) return;
    tag.content = tag.after.substring(0, end);
    tag.after = tag.after.substring(end + tag.captured.length);
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.