CVE-2026-60008

"modules/markup/jupyter/jupyter.go" sets "SanitizerDisabled: true" but leaves "DisplayInIframe" and "ContentSandbox" at their zero values. It is the only renderer in the tree that turns the sanitizer off while still rendering into the main document. Within that unsanitized output it interpolates...