Merge hotfix-xss