We already sanitize (using html.EscapeString) meta data fetched from saved bookmarks but we are not converting upon display on the site. We should run it through another sanitation call and then display it with htmlSafe template function. Should be good enough
Peter Sanchez referenced this ticket in commit f40c514.