In contrast, Voyager uses Remark for markdown parsing, specifically a subset of remark-gfm
The only extension on these standard, widely used and tested markdown components is for community links to work (like [email protected]) since they're Lemmy-specific. You can see that code here. Note that we parse into an abstract syntax tree, not HTML strings. Parsing into an abstract syntax tree is much more resistant to this kind of exploit.