fix(security): Prevent XSS (closes #4838)(closes #4844)