I think we should be good. We don't use Html.Raw() or IHtmlString anywhere except in the PreFormattedText HTML helper which is what we use for displaying package release notes. That helper method uses HttpUtility.HtmlEncode on the text to ensure safety.

        public static IHtmlString PreFormattedText(this HtmlHelper self, string text)
        {
            return self.Raw(HttpUtility.HtmlEncode(text).Replace("\n", "<br />").Replace("  ", "&nbsp; "));
        }