From 6b3012fc92a7b54d501ff21afe61edec7fc3517a Mon Sep 17 00:00:00 2001
From: Sangeeth Sudheer <sangeeth96@users.noreply.github.com>
Date: Mon, 19 Apr 2021 21:16:44 +0530
Subject: [PATCH] fix($core): escape meta tags correctly (fix #2831)

Fixes #2831
---
 packages/@vuepress/core/lib/client/root-mixins/updateMeta.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/@vuepress/core/lib/client/root-mixins/updateMeta.js b/packages/@vuepress/core/lib/client/root-mixins/updateMeta.js
index c2265702f2..880fa655b0 100644
--- a/packages/@vuepress/core/lib/client/root-mixins/updateMeta.js
+++ b/packages/@vuepress/core/lib/client/root-mixins/updateMeta.js
@@ -1,4 +1,5 @@
 import unionBy from 'lodash/unionBy'
+import escape from 'escape-html'
 
 export default {
   // created will be called on both client and ssr
@@ -132,7 +133,7 @@ function renderPageMeta (meta) {
   return meta.map(m => {
     let res = `<meta`
     Object.keys(m).forEach(key => {
-      res += ` ${key}="${m[key]}"`
+      res += ` ${key}="${escape(m[key])}"`
     })
     return res + `>`
   }).join('\n    ')