Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}".
<img class="figure-img" src="{{ .Get "src" }}" {{ with (.Get "title") }}alt="{{ . }}"{{ end }} />{{ with (.Get "title") }}<span class="caption">{{ . }}</span>{{ end }}