fix: markdown parser renders HTML tags inside backticks as live HTML #169

Closed
opened 2026-02-25 17:33:26 -08:00 by hikari · 0 comments
Owner

Description

When the terminal renders assistant messages containing inline code that wraps HTML tag names (e.g. `<input>`, `<div>`), the markdown parser outputs the raw HTML element rather than escaped inline code text.

Expected Behaviour

`<input>` should render as styled inline code displaying the literal text <input>.

Actual Behaviour

`<input>` renders as a live, interactive <input> element inserted into the terminal output.

Reproduction Steps

  1. Have Claude respond with a message containing an HTML tag name wrapped in backticks (e.g. `<input>`)
  2. Observe that the terminal renders an actual HTML element instead of inline code

Root Cause

The markdown parser (likely the Markdown.svelte component or its underlying library) is not sanitising/escaping HTML tag names that appear inside inline code spans before rendering. The rendered output treats the tag name as real HTML.

Fix

Ensure that inline code content has HTML special characters escaped before being inserted into the DOM, or use a markdown library option that sanitises HTML within code spans.

This issue was created with help from Hikari~ 🌸

## Description When the terminal renders assistant messages containing inline code that wraps HTML tag names (e.g. `` `<input>` ``, `` `<div>` ``), the markdown parser outputs the raw HTML element rather than escaped inline code text. ## Expected Behaviour `` `<input>` `` should render as styled inline code displaying the literal text `<input>`. ## Actual Behaviour `` `<input>` `` renders as a live, interactive `<input>` element inserted into the terminal output. ## Reproduction Steps 1. Have Claude respond with a message containing an HTML tag name wrapped in backticks (e.g. `` `<input>` ``) 2. Observe that the terminal renders an actual HTML element instead of inline code ## Root Cause The markdown parser (likely the `Markdown.svelte` component or its underlying library) is not sanitising/escaping HTML tag names that appear inside inline code spans before rendering. The rendered output treats the tag name as real HTML. ## Fix Ensure that inline code content has HTML special characters escaped before being inserted into the DOM, or use a markdown library option that sanitises HTML within code spans. ✨ This issue was created with help from Hikari~ 🌸
naomi closed this issue 2026-02-25 22:55:48 -08:00
Sign in to join this conversation.
No Label
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: nhcarrigan/hikari-desktop#169