HTML special characters are not escaped in some PEP headers

[gmilde]

The Docutils project recieved a security bug report regarding the Docutils PEP parser.
While the affected code is not used by "python/peps/" anymore, the problem persists in the function that replaced it in peps/sphinx-extensions.

Please advise me how to report the problem securely.

[hugovk]

Please see the security policy to report issues about this repo:

https://github.com/python/peps/security/policy

[JelleZijlstra]

If the security issue is just that a PEP author could inject code into a header that runs JS in a viewer's browser, I'm not sure that's a big issue: the only people with commit access to the PEPs also have the commit access to the PEP rendering pipeline, so they could already inject arbitrary JS.