A Markdown parser can produce exactly the right HTML and still leave your application exposed to XSS. Parsing answers what the input means. Sanitization decides which parts of that meaning are allowed to reach an HTML sink.
Source: [Dev.to](https://dev.to/mdfold/your-markdown-parser-is-not-your-xss-boundary-2gpk)