Fix xss vulnerability. Thanks @vadimr and @Hebo
Changelog and version