there was a recent XSS vuln (ironically caused by the emoji code which was ported over from hexbear afaik) and because of that lemmy set up more sanitization than necessary and ended up with this double-sanitized html mess. it’s on the issue tracker so it’ll get fixed at some point