Description of the problem
The search excerpt variable is stripped of HTML before displaying, but this leaves JS code behind when there's an encoded email address in that field, either with {encode="[email protected]"} or if the field is set to auto-encode email addresses in that channel's settings.

How To Reproduce
Steps to reproduce the behavior:

Put an email address in a text field.
Make sure the field is searchable.
Make sure email addresses in that field are set to auto encode by going to that channel's settings: "Render URLs and Email addresses as links?"
Search for that entry.
Use {excerpt} to display the result.

Error Messages

My email address is (JavaScript must be enabled to view this email address)/*= 0)out
 += decodeURIComponent(l[i].replace(/^\s\s*/, '&#'));while (--j >= 0)if 
(el[j].getAttribute('data-eeEncEmail_ZKvYhMmuXN'))el[j].innerHTML = out;/*]]>*/ 
so now you see JS code in search here now.

Screenshots / Videos / Template Code

Environment Details:

• Version: 7.5.7
• PHP Version any
• MySQL Version any
• OS: any
• Web Server: any

Possible Solution
Dunno but somewhere in ExpressionEngine/system/ee/ExpressionEngine/Addons/search/mod.search.php

Additional context