Anonymous GitHub fetches and renders GitHub repository README markdown content without sanitization, using the 'marked' library with sanitization disabled and AngularJS's $sce.trustAsHtml() to inject HTML. This allows an attacker to craft a malicious README that executes arbitrary JavaScript in the Anonymous GitHub origin, leading to stored cross-site scripting (XSS). The vulnerability can result in account takeover, theft of authentication tokens, and data exfiltration of user configurations and private repository data. A fix is available in version 2.3.0.