Merge commit from fork

escape entry type label

Author: brandonkelly

CHANGELOG.md

@@ -16,6 +16,7 @@
 - Fixed a bug where it wasn’t possible to copy/paste nested entries within Matrix fields set to the inline-editable blocks view mode, for unpublished owner elements. ([#18185](https://github.com/craftcms/cms/pull/18185))
 - Fixed a bug where custom fields’ checkboxes weren’t getting removed from field layouts’ “Card Attributes” lists when removed from the layout.
 - Fixed an SSRF vulnerability. (GHSA-96pq-hxpw-rgh8)
+- Fixed an XSS vulnerability. (GHSA-7pr4-wx9w-mqwr)
 
 ## 5.8.21 - 2025-12-04
 

src/services/Entries.php

@@ -1961,7 +1961,7 @@ public function getTableData(
         $usages = $this->allEntryTypeUsages();
 
         foreach ($entryTypes as $entryType) {
-            $label = $entryType->getUiLabel();
+            $label = Html::encode($entryType->getUiLabel());
             $chipCellContent = Html::beginTag('div', ['class' => 'inline-chips']) .
                 Cp::chipHtml($entryType, [
                     'labelHtml' => Html::a($label, $entryType->getCpEditUrl(), [