From 247d08d296e72ec9b978213a46b50d38ffd37803 Mon Sep 17 00:00:00 2001
From: "suhyun.nam" <suhyun.nam@gmail.com>
Date: Sat, 7 Nov 2026 15:48:03 +0900
Subject: [PATCH 1/2] Escape Mermaid source before inserting into HTML #2054

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../QuickLook.Plugin.MarkdownViewer/Resources/md2html.html      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/QuickLook.Plugin/QuickLook.Plugin.MarkdownViewer/Resources/md2html.html b/QuickLook.Plugin/QuickLook.Plugin.MarkdownViewer/Resources/md2html.html
index 920254c7b..23fca7a0f 100644
--- a/QuickLook.Plugin/QuickLook.Plugin.MarkdownViewer/Resources/md2html.html
+++ b/QuickLook.Plugin/QuickLook.Plugin.MarkdownViewer/Resources/md2html.html
@@ -224,7 +224,7 @@
           quotes: "“”‘’",
           highlight: function (str, lang) {
             if (lang === 'mermaid') {
-              return '<div class="mermaid">' + str + '</div>';
+              return '<div class="mermaid">' + md.utils.escapeHtml(str) + '</div>';
             }
             if (lang && hljs.getLanguage(lang)) {
               try {

From a05f6a4acb98fbcc27d0ecbe1d7f1b8322b6792f Mon Sep 17 00:00:00 2001
From: "suhyun.nam" <suhyun.nam@gmail.com>
Date: Sat, 7 Nov 2026 16:11:36 +0900
Subject: [PATCH 2/2] Escape only "<" in Mermaid source to keep existing
 diagrams working #2054

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../QuickLook.Plugin.MarkdownViewer/Resources/md2html.html    | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/QuickLook.Plugin/QuickLook.Plugin.MarkdownViewer/Resources/md2html.html b/QuickLook.Plugin/QuickLook.Plugin.MarkdownViewer/Resources/md2html.html
index 23fca7a0f..9083d2b21 100644
--- a/QuickLook.Plugin/QuickLook.Plugin.MarkdownViewer/Resources/md2html.html
+++ b/QuickLook.Plugin/QuickLook.Plugin.MarkdownViewer/Resources/md2html.html
@@ -224,7 +224,9 @@
           quotes: "“”‘’",
           highlight: function (str, lang) {
             if (lang === 'mermaid') {
-              return '<div class="mermaid">' + md.utils.escapeHtml(str) + '</div>';
+              // Only "<" can start markup (e.g. "<<interface>>"), so escape just that;
+              // other entities are left untouched to keep existing diagrams unaffected.
+              return '<div class="mermaid">' + str.replace(/</g, '&lt;') + '</div>';
             }
             if (lang && hljs.getLanguage(lang)) {
               try {