When HTML appears in a JUnit failure message, the junitreport macro does not escape it. So displaying failure messages with HTML in them displays the formatted HTML snippets inside the junitreport output table. See example files.

Also, the stack trace doesn't seem to be <pre> format either, the lines wrap instead of being on separate lines (also fixed in K:\junitreport_escaped.htm example).