Merge pull request from GHSA-g6w6-7xf9-m95p

Don't store mermaid diagrams in innerHTML

public/js/extra.js

@@ -386,7 +386,7 @@ export function finishView (view) {
 
       window.mermaid.mermaidAPI.parse($value.text())
       $ele.addClass('mermaid')
-      $ele.html($value.text())
+      $ele.text($value.text())
       window.mermaid.init(undefined, $ele)
     } catch (err) {
       var errormessage = err