Commit "e6b66aa" ("fix(bazar): leave the twig escape placeholder as is", 2026-05-19) recognised that emitting "field.label" through Twig's "raw('html')" filter into an HTML attribute is unsafe — Twig's "raw" marker suppresses the attribute auto-escape, "striptags" removes "<…>" tags but not """, so a label containing """ can break out of the attribute and inject event-handler attributes. The commit fixed "tools/bazar/templates/inputs/text.twig:19" and "tools/bazar/templates/inputs/textarea.twig:3". At least seven additional templates have the same pattern and were not touched by the fix: - "tools/bazar/templates/inputs/range.twig:19" — "placeholder="{{ field.label|raw('html')|striptags }}"" - "tools/bazar/templates/inputs/email.twig:13" — "placeholder="{{ field.label|raw('html')|striptags }}"" - "tools/bazar/templates/layouts/input.twig:7" — "title="{{ field.hint|raw('html') }}" alt="{{ field.hint|raw('html') }}"" - "tools/bazar/templates/inputs/textarea.twig:14" — same "title="/"alt=" pattern (the commit only fixed line 3, line 14 remains) - "tools/bazar/templates/inputs/user.twig:41, 55" — same - "tools/bazar/templates/inputs/bookmarklet.twig:4" — same - "tools/bazar/templates/layouts/input.twig:9", "tools/bazar/templates/layouts/field.twig:5", "tools/bazar/templates/inputs/subscribe.twig:16", "tools/bazar/templates/inputs/linked-entry.twig:4", "tools/bazar/templates/inputs/textarea.twig:16", "tools/bazar/templates/inputs/bookmarklet.twig:6" — "{{ field.label|raw }}" outside an attribute (label-body), with no "striptags" at all, so direct tag injection ("<img src=x onerror=…>") executes The "layouts/input.twig" and "layouts/field.twig" files are base layouts inherited by every Bazar field type, so a single malicious "field.hint" reaches into every form that uses that field.