flawopen.com/XSS/Markdown rendering
Not automatically. Most markdown renderers pass raw HTML embedded in the markdown source straight through by default, since "allow raw HTML in markdown" is part of the original spec's design.
Markdown feels like a "safe" text format compared to raw HTML, so it's easy to assume rendering user-submitted markdown is inherently safe. In practice, most markdown parsers (CommonMark-compliant ones especially) explicitly support inline raw HTML as a feature — meaning <script>alert(1)</script> written directly in a markdown comment often renders exactly as it would in raw HTML, unless the renderer is explicitly configured otherwise.
Historically many did not by default — check your specific library's current configuration options rather than assuming; several now offer or recommend pairing with a dedicated sanitizer step.