escape text in ssr

packages/ssr/src/cache.rs

@@ -82,7 +82,13 @@ impl StringCache {
                 }
                 cur_path.pop();
             }
-            TemplateNode::Text { text } => write!(chain, "{text}")?,
+            TemplateNode::Text { text } => {
+                write!(
+                    chain,
+                    "{}",
+                    askama_escape::escape(text, askama_escape::Html)
+                )?;
+            }
             TemplateNode::Dynamic { id: idx } | TemplateNode::DynamicText { id: idx } => {
                 chain.segments.push(Segment::Node(*idx))
             }