Relevant to #3313 and #3373.
It is currently possible to construct a cube whose attributes contain strings with arbitrary html in them (for example, cube.attributes['bad html'] = "...</td><td>---" would break the formatting of the table). Their html_repr is not currently sanitizing such text. It might be wise to call html.escape() on such text when it is used to construct html objects.