diff -u b/core/modules/system/lib/Drupal/system/Controller/SystemController.php b/core/modules/system/lib/Drupal/system/Controller/SystemController.php
--- b/core/modules/system/lib/Drupal/system/Controller/SystemController.php
+++ b/core/modules/system/lib/Drupal/system/Controller/SystemController.php
@@ -7,6 +7,7 @@
 
 namespace Drupal\system\Controller;
 
+use Drupal\Core\Access\CsrfTokenGenerator;
 use Drupal\Core\Controller\ControllerBase;
 use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
 use Drupal\Core\Entity\Query\QueryFactory;
@@ -34,16 +35,26 @@
   protected $systemManager;
 
   /**
+   * The Csrf token generator service.
+   *
+   * @var \Drupal\Core\Access\CsrfTokenGenerator
+   */
+  protected $tokenGenerator;
+
+  /**
    * Constructs a new SystemController.
    *
    * @param \Drupal\system\SystemManager $systemManager
    *   System manager service.
    * @param \Drupal\Core\Entity\Query\QueryFactory $queryFactory
    *   The entity query object.
+   * @param \Drupal\Core\Access\CsrfTokenGenerator $token_generator
+   *   The token generator service.
    */
-  public function __construct(SystemManager $systemManager, QueryFactory $queryFactory) {
+  public function __construct(SystemManager $systemManager, QueryFactory $queryFactory, CsrfTokenGenerator $token_generator) {
     $this->systemManager = $systemManager;
     $this->queryFactory = $queryFactory;
+    $this->tokenGenerator = $token_generator;
   }
 
   /**
@@ -52,7 +63,8 @@
   public static function create(ContainerInterface $container) {
     return new static(
       $container->get('system.manager'),
-      $container->get('entity.query')
+      $container->get('entity.query'),
+      $container->get('csrf_token')
     );
   }