HTML injection (Improper Sanitization of Script-Related HTML Tags in a Web Page, Basic XSS) CWE-80

Describe the bug
It is possible to insert html code and execute it
<style>body { background-color: blue }</style>
<iframe src="javascript:alert(0)"></iframe>

Expected behavior
Html chars escaped

Minimal reproducible OpenAPI snippet(if possible)

{
    "openapi": "3.0.0",
    "info": {
        "title": "title",
        "description": "description",
        "version": "0.0.1"
    },
    "paths": {
        "/path": {
            "get": {
                "operationId": "operationId",
                "summary": "summary",
                "description": "description <iframe src=\"javascript:alert(0)\"></iframe>",
                "parameters": [
                    {
                        "name": "X-NAME",
                        "in": "header",
                        "description": "Some description <style>body { background-color: blue }</style>",
                        "required": true,
                        "schema": {
                            "maxLength": 255,
                            "type": "string"
                        }
                    }
                ],
                "responses": {
                    "200": {
                        "description": "Success <iframe src=\"javascript:alert(0)\"></iframe>"
                    }
                }
            }
        }
    }
}

Screenshots

Start by loading the supplied OpenAPI snippet in the Redoc UI and confirm how the description fields are rendered. Trace the rendering path for descriptions and verify that the style and javascript iframe payloads are displayed as text rather than executed; done means the reproduced XSS no longer runs.