md_data_uri

e

MDDATA [x](data:text/html,<script>alert(1)</script>)