Unescaped HTML in shared-note list