Vulnerability affecting Drupal 7, 8.9, 9.0 and 9.1. Drupal core's sanitization API fails to properly filter cross-site scripting under certain circumstances.

https://www.drupal.org/sa-core-2021-002