Bitcoin Core v30 and later relay, index, and expose up to 100,000 bytes of arbitrary OP_RETURN data by default. When an attacker embeds a self-rendering Data URI (e.g., data:image/*;base64,…) inside an OP_RETURN output, Bitcoin Core stores the content and makes it accessible through standard JSON-RPC and REST interfaces. Any client retrieving the transaction through these interfaces receives the Data URI in cleartext, which can be immediately rendered by a web browser or other HTTP-capable software without specialized tooling.
This behavior may unintentionally cause node operators to store, retrieve, or serve content that is harmful, illegal, or high-risk, creating operational, security, and legal exposure for downstream systems.