Escape language name in codehilite non-Pygments output

docs/changelog.md

@@ -12,6 +12,13 @@ and this project adheres to the
 [Python Version Specification](https://packaging.python.org/en/latest/specifications/version-specifiers/).
 See the [Contributing Guide](contributing.md) for details.
 
+## [Unreleased]
+
+### Fixed
+
+* Escape the language name in the `codehilite` extension's non-Pygments output so
+  a language value cannot break out of the `class` attribute and inject markup.
+
 ## [3.11.2] - 2026-10-19
 
 ### Fixed

markdown/extensions/codehilite.py

@@ -24,6 +24,7 @@
 from . import Extension
 from ..treeprocessors import Treeprocessor
 from ..util import parseBoolValue
+from ..serializers import _escape_attrib_html
 from typing import TYPE_CHECKING, Callable, Any
 
 if TYPE_CHECKING:  # pragma: no cover
@@ -179,7 +180,7 @@ def hilite(self, shebang: bool = True) -> str:
             txt = txt.replace('"', '"')
             classes = []
             if self.lang:
-                classes.append('{}{}'.format(self.lang_prefix, self.lang))
+                classes.append('{}{}'.format(self.lang_prefix, _escape_attrib_html(self.lang)))
             if self.options['linenos']:
                 classes.append('linenums')
             class_str = ''

tests/test_syntax/extensions/test_code_hilite.py

@@ -140,6 +140,13 @@ def test_codehilite_use_pygments_false(self):
         )
         self.assertOutputEquals('<?php print("Hello World"); ?>', expected, lang='php', use_pygments=False)
 
+    def test_codehilite_lang_escaped(self):
+        expected = (
+            '<pre class="codehilite"><code class="language-&quot;&gt;&lt;script&gt;">text\n'
+            '</code></pre>'
+        )
+        self.assertOutputEquals('text', expected, lang='"><script>', use_pygments=False)
+
     def test_codehilite_lang_prefix_empty(self):
         expected = (
             '<pre class="codehilite"><code class="php">&lt;?php print(&quot;Hello World&quot;); ?&gt;\n'