Issue Title: security: escape inline style values to prevent SVG attribute injection #8 Merged by: balintorosz Commit: 1 commit from branch into Comments by willdollman: - Vulnerability allows crafted Mermaid diagrams to inject SVG attributes, enabling XSS and element injection. - User-controlled values from and are directly interpolated without escaping. - Fix uses on properties ( , , , ) to prevent injection. Examples Provided: - Injecting JavaScript executed on page load showing injection. - Injecting an external image via manipulation of attribute with to harmful image sources. Outcome: - fix involves escaping characters and to mitigate the vulnerability.