AIKIDO-2026-154288

TL;DR

When strip_tags is disabled (the default), DefaultConverter, DivConverter, and LinkConverter keep tags without a Markdown equivalent by serializing the element and entity-decoding the whole result, including its start tag. Decoding the start tag turns an encoded quote inside an attribute value into a literal quote, ending that attribute early and letting the remainder of the value add new attributes such as event handlers. The input passes HTML Purifier because it holds one correctly encoded attribute and no <script> element or event handler attribute until after conversion. The fix stops entity-decoding the start tag of preserved elements.