Hacker News Reader

Vulnerable to XSS.

<b onmouseover=alert('XSS')>click me!</b>

XSS implies that you can get this script to run for other users, not just yourself.

I suspect it would work the same if the script was stored in a TXT record for a domain being queried.

There is even a tool for this called dnsxss.