XSS via Markdown content

Steps to reproduce:

1. Install the CommonMark markdown syntax.
2. Login as user without script right.
3. Edit any document and set the syntax to Markdown.
4. Add to any field of that document or a comment the content <script>alert("XSS")</script>

Expected result:

No alert is displayed as the user doesn't have script right.

Actual result:

An alert with content "XSS" is displayed.