Default preset (html=True) diverges from upstream JS markdown-it (html:false): untrusted raw HTML injected by default -> XSS

[plotarmordev]

Security-relevant default drift in markdown-it-py (Python port)

markdown-it-py 4.2.0 MarkdownIt().options.html defaults to True, whereas the upstream JS markdown-it 15.0.0 'default' preset defaults to html:false (escapes raw HTML).

Repro (Python):

from markdown_it import MarkdownIt
print(MarkdownIt().render('<script>alert(1)</script>'))
# -> '<script>alert(1)</script>'   (raw script in output => executes)

JS reference (same 'default' preset): md.render('<script>..') -> <script>.. (escaped, inert).

Consequence: an app that renders UNTRUSTED markdown through markdown-it-py with default options (as one would with the JS library's secure default) gets stored/reflected HTML/script injection that the JS library prevents by default. All extant markdown-it-py advisories (GHSA-jrwr-5x3p-hvc3, GHSA-vrjv-mxr7-vjf8, PYSEC-2023-23/24) are DoS; none cover this.

Ask: make the 'default' preset mirror upstream (html:false), or at minimum document the security implication and recommend html=False / sanitizer for untrusted input.