Turn on MathJax Safe extension...
Turn on MathJax Safe extension
Not having this on allows mathjax links in Markdown cells which can execute javascript that are not sanitized by caja, for example:
$E \href{javascript:alert("Einstein says so!")}{=} mc^2$
See
http://docs.mathjax.org/en/latest/safe-mode.html for more details.