CVE-2026-6367

@@ -329,6 +329,9 @@ public function __toString() {
     $return = '';
     /** @var \Drupal\Core\Template\AttributeValueBase $value */
     foreach ($this->storage as $value) {
+      if (!$value instanceof AttributeValueBase) {
+        throw new \RuntimeException(sprintf('Unexpected type for $value (%s).', get_debug_type($value)));
+      }
       $rendered = $value->render();
       if ($rendered) {
         $return .= ' ' . $rendered;

@@ -2553,6 +2553,33 @@ public function __sleep(): array {
    * Magic method implementation to unserialize the view executable.
    */
   public function __wakeup(): void {
+    $reflection = new \ReflectionClass($this);
+    $defaults = $reflection->getDefaultProperties();
+    foreach ($reflection->getProperties() as $property) {
+      $name = $property->getName();
+      if ($name === 'serializationData') {
+        $expected_keys = [
+          'args',
+          'current_display',
+          'current_page',
+          'dom_id',
+          'executed',
+          'exposed_data',
+          'exposed_input',
+          'exposed_raw_input',
+          'storage',
+        ];
+        $actual_keys = array_keys($this->serializationData);
+        sort($actual_keys);
+        if ($actual_keys !== $expected_keys) {
+          throw new \RuntimeException(sprintf('Unexpected keys in %s::$%s.', __CLASS__, $name));
+        }
+      }
+      elseif (array_key_exists($name, $defaults) && $this->$name !== $defaults[$name]) {
+        throw new \RuntimeException(sprintf('Deserialization of %s::$%s is not allowed.', __CLASS__, $name));
+      }
+    }
+
     // There are cases, like in testing where we don't have a container
     // available.
     if (\Drupal::hasContainer() && !empty($this->serializationData)) {

@@ -233,7 +233,7 @@ protected function createSuggestion(EntityInterface $entity): array {
       'entity_type_id' => $entity->getEntityTypeId(),
       'entity_uuid' => $entity->uuid(),
       'group' => $this->computeGroup($entity),
-      'label' => $entity->label(),
+      'label' => Html::escape($entity->label() ?? ''),
       // Use the canonical URI as a valid fallback for the href. The
       // text_format filter will transform this to the final URL (e.g., alias).
       'path' => $entity->toUrl('canonical')->toString(),

@@ -3,6 +3,7 @@
 namespace Drupal\Core\Ajax;
 
 use Drupal\Component\Render\PlainTextOutput;
+use Drupal\Component\Utility\Xss;
 
 /**
  * Defines an AJAX command to open certain content in a dialog.
@@ -146,6 +147,20 @@ public function setDialogTitle($title) {
   public function render() {
     // For consistency ensure the modal option is set to TRUE or FALSE.
     $this->dialogOptions['modal'] = isset($this->dialogOptions['modal']) && $this->dialogOptions['modal'];
+
+    if (!empty($this->dialogOptions['buttons'])) {
+      foreach ($this->dialogOptions['buttons'] as &$button) {
+        // Only allow specific attributes to be defined for a button.
+        $button = \array_intersect_key($button, \array_flip(['disabled', 'icons', 'label', 'text']));
+        foreach ($button as &$value) {
+          if (is_string($value)) {
+            // Apply Xss::filter to button attribute values.
+            $value = Xss::filter($value);
+          }
+        }
+      }
+    }
+
     return [
       'command' => 'openDialog',
       'selector' => $this->selector,