diff --git a/src/domain/session/room/timeline/deserialize.js b/src/domain/session/room/timeline/deserialize.js
index 603cb438..02e099b8 100644
--- a/src/domain/session/room/timeline/deserialize.js
+++ b/src/domain/session/room/timeline/deserialize.js
@@ -345,6 +345,13 @@ export function tests() {
             ];
             test(assert, input, output);
         },
+        "Unknown and invalid attributes are stripped": assert => {
+            const input = '<em onmouseover=alert("Bad code!")>Hello</em>';
+            const output = [
+                new FormatPart("em", [new TextPart("Hello")])
+            ];
+            test(assert, input, output);
+        },
         /* Doesnt work: HTML library doesn't handle <pre><code> properly.
         "Text with code block": assert => {
             const code = 'main :: IO ()\nmain = putStrLn "Hello"'