safemode? is valid?      

<IMG SRC="javascript:alert('XSS');">

Text formatted with Texy:

Generated HTML code:

<div><img src="javascript:alert('XSS');"></div>

Verze Texy: 3.2.3 (konfigurace)