Yesterday someone found CSS injection on Github profile using Math mode. Now Patched BTW (kennethnym.com)