This issue is similar to issue2550836.
We have a detector that prevents closing an issue if it has open
dependencies:
http://hg.python.org/tracker/python-dev/file/b9748aeeecd8/detectors/statusauditor.py#l40
This is done by raising a ValueError with a message that contains an
HTML link.

AFAIU, this ValueError is caught in cgi/actions.py, and the
add_error_message() escapes the HTML included in the message:
http://hg.python.org/tracker/roundup/file/c783a6df3ffe/roundup/cgi/actions.py#l628

This could be fixed easily by adding escape=False (see attached patch).
I verified that this doesn't affect the exploit presented in
issue2550817 (unknown properties are handled elsewhere), however it
seems that the error message could arrive from several different places,
so I'm not entirely sure it's safe to add escape=False.
Can someone more familiar with this code comment?