fix(markdown): escape double quotes in link href/title and image title

[yashs33244]

What

The Markdown renderer escapes double quotes in image src and alt, but not in link href, link title, or image title - those are interpolated raw into the attribute:

renderer.image = ({ href, text, title }) =>
  `<img src="${href.replaceAll('"', '&quot;')}" alt="${text.replaceAll('"', '&quot;')}"${
    title ? ` title="${title}"` : ''   // not escaped
  }…>`;

renderer.link = ({ href, title, tokens }) =>
  `<a href="${href}" target="_blank"${    // not escaped
    title ? ` title="${title}"` : ''      // not escaped
  }…>`;

So a markdown title that contains a double quote breaks out of the attribute:

[guide](https://example.com 'The "Complete" Guide')
-> <a … title="The "Complete" Guide" …>   // attribute terminates at the first "

The same happens for an image title and for an href that contains a quote.

Fix

Apply the same .replaceAll('"', '"') already used for image src/alt to link href, link title, and image title. Added a regression test rendering a link and image whose title/href contain quotes. Existing snapshots are unaffected.

---

Summary by cubic

Escape double quotes in react-email’s Markdown renderer for link href/title and image title to prevent HTML attribute breakouts, matching the existing escaping for image src/alt. Adds a regression test that covers quotes in link/image titles and hrefs.

^{Written for commit 0aef517. Summary will update on new commits.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 0aef517

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
react-email	Patch
@react-email/editor	Patch
@react-email/ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@yashs33244 is attempting to deploy a commit to the resend Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Auto-approved: Fixes an HTML attribute escaping bug in the Markdown renderer by applying the same replaceAll pattern already used for image src/alt to link href/title and image title. The change is small (3 files, 23 lines), isolated, test-covered, and does not affect any snapshots.

Re-trigger cubic</sub>

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/react-email@3590

commit: 0aef517