Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}".
<a href="#posts-list-{{ .category.name | urlize }}" class="category-anchor" data-category="{{ .category.name }}" data-parent-categories="{{ delimit $ancestors "," }}"> / {{ .category.name }}</a>