https://"><script>alert(1)</script>
and if you click the bookmarklet for the page that comment was discussing then their javascript will execute in your logged in context on that website.[1]: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...
For people reading this, the parent comment is referring to this line[1] from a previous revision of the gist.
[1]: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...
That was not the line, it was linking to this innerHTML call: https://gist.github.com/postmalloc/e2602752d46c5b9dee2446235...
Also as a defense mitigation I don't think escaping is ever going to be effective, it would be better to create anchor elements directly. With your current approach I can still XSS with, for instance:
https://"onmouseenter=alert(1)"Relevant comment: https://news.ycombinator.com/item?id=30187483