Is there an existing issue for this?

• I have searched the existing issues and did not find a similar issue

This bug exists on the latest available release of DistroAV and supported environment?

• I have checked this bug still exists on the latest available version of DistroAV.
• I have checked that my OS / OBS / NDI versions are supported & up-to-date.

OBS Log [URL] - Important!

No response

Issue reported - Current Behavior

If a plugin release includes release notes containing a < or >, the display in the markdown widget does not render correctly and may show broken formatting or even inject unexpected HTML. This also creates a potential vector for script injection if not handled properly.

Expected Behavior

Any release notes (particularly those from upstream or user input) should be HTML-escaped before being rendered as markdown. The GUI should never allow display of raw < or > characters as HTML in markdown fields.

Steps To Reproduce

1. Make a release with release notes like: <script>alert(1)</script> or <<<Test>>>.
2. Trigger the update notification in the plugin.
3. Observe that the markdown field renders the HTML rather than displaying as literal text, or the formatting is broken.

Environment

- OS: n/a
- OBS: n/a
- DistroAV: 6.x
- NDI: n/a

Pre-Check for Bug Report

• I am able to reproduce the bug following the steps provided above
• I have confirmed this bug exist on more than one device/computer
• I have tested using a new scene collection to reproduce the issue
• I have tested on a 'clean' OBS installation (aka with no other scripts or plugin installed)
• I am filing this bug report as a Human and have reviewed its content to the best of my ability to ensure it's accurate.