=== modified file 'Mailman/Cgi/listinfo.py'
--- Mailman/Cgi/listinfo.py	2010-06-24 04:09:34 +0000
+++ Mailman/Cgi/listinfo.py	2010-09-05 14:38:30 +0000
@@ -97,7 +97,7 @@
             else:
                 advertised.append((mlist.GetScriptURL('listinfo'),
                                    mlist.real_name,
-                                   mlist.description))
+                                   Utils.websafe(mlist.description)))
     if msg:
         greeting = FontAttr(msg, color="ff5060", size="+1")
     else:

=== modified file 'Mailman/HTMLFormatter.py'
--- Mailman/HTMLFormatter.py	2008-02-03 19:27:07 +0000
+++ Mailman/HTMLFormatter.py	2010-09-05 00:15:08 +0000
@@ -383,8 +383,9 @@
             '<mm-mailman-footer>' : self.GetMailmanFooter(),
             '<mm-list-name>' : self.real_name,
             '<mm-email-user>' : self._internal_name,
-            '<mm-list-description>' : self.description,
-            '<mm-list-info>' : BR.join(self.info.split(NL)),
+            '<mm-list-description>' : Utils.websafe(self.description),
+            '<mm-list-info>' : 
+                '<!---->' + BR.join(self.info.split(NL)) + '<!---->',
             '<mm-form-end>'  : self.FormatFormEnd(),
             '<mm-archive>'   : self.FormatArchiveAnchor(),
             '</mm-archive>'  : '</a>',

diff --git a/Mailman/Utils.py b/Mailman/Utils.py
index 78c2933..4eb3e60 100644
--- Mailman/Utils.py
+++ Mailman/Utils.py
@@ -887,6 +887,7 @@ _badwords = [
     '<i?frame',
     '<link',
     '<meta',
+    '<object',
     '<script',
     r'(?:^|\W)j(?:ava)?script(?:\W|$)',
     r'(?:^|\W)vbs(?:cript)?(?:\W|$)',