From 0bd4a6f8a18abdb638b1583308316a51eb0b8a1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Wed, 30 Sep 2026 09:39:21 +0200
Subject: [PATCH] Escape title and text when rendering HTML editor

Closes #15032
(grafted from 0c76d2bc755882d3633a9452c585412f7847d797)

--HG--
branch : 8.0
---
 trytond/CHANGELOG            | 1 +
 trytond/trytond/ir/routes.py | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/trytond/CHANGELOG b/trytond/CHANGELOG
index a9b0a610af..e61a526772 100644
--- a/trytond/CHANGELOG
+++ b/trytond/CHANGELOG
@@ -1,3 +1,4 @@
+* Escape title and text when rendering HTML editor (issue15032)
 
 Version 8.0.10 - 2026-09-16
 ---------------------------
diff --git a/trytond/trytond/ir/routes.py b/trytond/trytond/ir/routes.py
index 7db00886cf..7bc5a20d5b 100644
--- a/trytond/trytond/ir/routes.py
+++ b/trytond/trytond/ir/routes.py
@@ -2,6 +2,7 @@
 # this repository contains the full copyright notices and license terms.
 import csv
 import datetime as dt
+import html
 import io
 import json
 from numbers import Number
@@ -92,8 +93,8 @@ def html_editor(request, pool, model, record, field):
                 'class': get_config(
                     ['class', model, field.name], default="''"),
                 'language': transaction.language,
-                'title': title,
-                'text': text,
+                'title': html.escape(title),
+                'text': html.escape(text),
                 'csrf_token': csrf_token,
                 'error': error,
                 }, status, content_type='text/html')