Seems that it would be possible for someone to interpolate in a "content" element and not realize that values are not escaped. This seems like a grey area but opt-in is more likely to be expected? I'm not sure what would fix this but I think the __str__ method of Element might be the issue. I just tried to make a test to demonstrate the issue.

An example I'll try to create a test for might be to inject a closing tag into a style tag, then a script tag and then re-start the style as if nothing happened.