SafeHTML v1 (docs/SAFE_HTML_V1.md §3.6): <svg> is HTML5 foreign-content -- the tokenizer switches into the SVG namespace for everything inside it, but a <script> element inside that namespace is still recognized and STILL EXECUTES (<svg><script>alert(1)</script></svg> is a well-known, browser-verified XSS payload class, inline in an ordinary HTML document, not just a standalone .svg file). A previous version of this class overrode render_children to pass String children through completely unescaped ("SVG content is not escaped like HTML") -- that is exactly as dangerous as <script> accepting a plain-String child, just reached through a different element. There is no legitimate reason a String child of Svg needs to bypass escaping: real hand-authored SVG markup (<path d="..."> and friends) is built the same way any other raw/vouched markup is in this shard -- RawHTML.new(...) / add_raw_html(...) (already a documented, greppable raw door, see docs/SAFE_HTML_V1.md §4) -- not by relying on Svg silently treating every String as markup. Removing the override restores the inherited, safe ContainerElement#render_children behavior: HTMLElement/RawHTML children render as before, and a String child is HTML-escaped like a text node on every other element.