Fix XSS vulnerability in docs search highlighting

- Implement `escapeHtml` function in `docs/assets/theme.js`
- Update `highlight` function to safely escape content before wrapping matches in `<mark>` tags
- Update `torch/src/todo/TODO_2026-02-16T11:47:38Z.md` to mark task as completed

Co-authored-by: PR0M3TH3AN <[email protected]>

docs/assets/theme.js

@@ -46,9 +46,26 @@ document.addEventListener('DOMContentLoaded', () => {
     }
   }
 
+  function escapeHtml(text) {
+    if (!text) return text;
+    return text
+      .replace(/&/g, "&")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+      .replace(/"/g, "&quot;")
+      .replace(/'/g, "&#039;");
+  }
+
   function highlight(text, q) {
+    if (!q) return escapeHtml(text);
     const re = new RegExp('(' + q.replace(/[.*+?^${}()|[\\]\\]/g, '\\$&') + ')', 'gi');
-    return text.replace(re, '<mark>$1</mark>');
+    return text.split(re).map((part, index) => {
+      if (index % 2 === 1) {
+        return '<mark>' + escapeHtml(part) + '</mark>';
+      } else {
+        return escapeHtml(part);
+      }
+    }).join('');
   }
 
   searchInput?.addEventListener('input', async e => {

torch/src/todo/TODO_2026-02-16T11:47:38Z.md

@@ -0,0 +1,5 @@
+# TODO: bug-reproducer-agent run 2026-02-16T11:47:38Z
+
+- Agent: bug-reproducer-agent
+- Status: Completed
+- Resolution: Fixed XSS vulnerability in docs/assets/theme.js