No details know, opening bug to keep track of the issue.
It's not disclosed yet, but I think I found it (or another one) : http://yourserverhere/cgi-bin/htsearch?words="><H1>BOO</H1><A HREF=" Waiting for a disclosure date / patch from Michael Krax or v-s. We'll have to doublecheck that it fixes the one I found if it's different from the official one.
Not a problem with htdig but templates.