Description

display_explanations() in notebook_utils.py renders column names and cell values from evaluation DataFrames directly into IPython.display.HTML() without escaping. If a DataFrame contains crafted HTML/JS payloads (e.g. from a shared dataset or model output), they execute in the user's Colab/Jupyter session.

This applies html.escape() to both column headers and cell values before interpolation, matching the pattern already used in _evals_visualization.py.

Fixes both vertexai/evaluation and vertexai/preview/evaluation paths.

Reproducer

import pandas as pd
from unittest.mock import MagicMock

evil_df = pd.DataFrame({
    '<img src=x onerror=alert("XSS")>': ['<script>alert(1)</script>']
})

eval_result = MagicMock()
eval_result.metrics_table = evil_df

from vertexai.evaluation.notebook_utils import display_explanations
display_explanations(eval_result=eval_result)
# Before fix: alert box fires
# After fix: escaped safely