diff --git a/docs/assets/theme.js b/docs/assets/theme.js
index 518779eb..88670fbe 100644
--- a/docs/assets/theme.js
+++ b/docs/assets/theme.js
@@ -46,9 +46,26 @@ document.addEventListener('DOMContentLoaded', () => {
     }
   }
 
+  function escapeHtml(text) {
+    if (!text) return text;
+    return text
+      .replace(/&/g, "&")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+      .replace(/"/g, "&quot;")
+      .replace(/'/g, "&#039;");
+  }
+
   function highlight(text, q) {
+    if (!q) return escapeHtml(text);
     const re = new RegExp('(' + q.replace(/[.*+?^${}()|[\\]\\]/g, '\\$&') + ')', 'gi');
-    return text.replace(re, '<mark>$1</mark>');
+    return text.split(re).map((part, index) => {
+      if (index % 2 === 1) {
+        return '<mark>' + escapeHtml(part) + '</mark>';
+      } else {
+        return escapeHtml(part);
+      }
+    }).join('');
   }
 
   searchInput?.addEventListener('input', async e => {
diff --git a/torch/src/todo/TODO_2026-02-16T11:47:38Z.md b/torch/src/todo/TODO_2026-02-16T11:47:38Z.md
new file mode 100644
index 00000000..79240ef3
--- /dev/null
+++ b/torch/src/todo/TODO_2026-02-16T11:47:38Z.md
@@ -0,0 +1,5 @@
+# TODO: bug-reproducer-agent run 2026-02-16T11:47:38Z
+
+- Agent: bug-reproducer-agent
+- Status: Completed
+- Resolution: Fixed XSS vulnerability in docs/assets/theme.js