Hacker News Reader

Improper input sanitation, you can potentially add raw html to other people's pages (XSS).

Doesn't the regex sanitize it before display?

Yes but it's pretty easily bypassed

How is it easily bypassed?

I asked earlier because I'm genuinely curious, but do you have a payload that would bypass this particular regex?