Merge branch '4.x' of https://github.com/craftcms/cms into 5.x

Author: brandonkelly

CHANGELOG.md

@@ -19,6 +19,7 @@
 - Fixed an SSRF vulnerability. (GHSA-96pq-hxpw-rgh8)
 - Fixed an XSS vulnerability. (GHSA-7pr4-wx9w-mqwr)
 - Fixed a SQL injection vulnerability. (GHSA-2453-mppf-46cj)
+- Fixed an XSS vulnerability. (GHSA-9f5h-mmq6-2x78)
 
 ## 5.8.21 - 2025-12-04
 

src/templates/_components/fieldtypes/Number/input.twig

@@ -25,7 +25,7 @@
 <div class="flex">
     {% if hasPrefix %}
         <div aria-hidden="true">
-            {{ prefix|t('site')|md(inlineOnly=true)|raw }}
+            {{ prefix|t('site')|md(inlineOnly=true,encode=true)|raw }}
         </div>
     {% endif %}
     <div>
@@ -42,7 +42,7 @@
     </div>
     {% if hasSuffix %}
         <div aria-hidden="true">
-            {{ suffix|t('site')|md(inlineOnly=true)|raw }}
+            {{ suffix|t('site')|md(inlineOnly=true,encode=true)|raw }}
         </div>
     {% endif %}
 </div>