govuk_tech_docs versions from 2.0.2 up to but not including 3.3.1 are vulnerable to a cross-site scripting (XSS) issue on the search results page. The vulnerability arises because HTML code snippets in indexed pages appear unsanitised in search results, allowing arbitrary HTML or scripts to be rendered. Exploitation requires an attacker to commit malicious code to an indexed page, which is typically difficult due to restricted editing access. The vulnerability is fixed in version 3.3.1 by sanitising HTML in search results.