diff --git a/core/includes/batch.inc b/core/includes/batch.inc
index cc70557..bf24ca5 100644
--- a/core/includes/batch.inc
+++ b/core/includes/batch.inc
@@ -14,6 +14,7 @@
  * @see batch_get()
  */
 
+use Drupal\Component\Utility\Xss;
 use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Component\Utility\Timer;
 use Drupal\Component\Utility\UrlHelper;
@@ -116,11 +117,15 @@ function _batch_progress_page() {
   $current_set = _batch_current_set();
 
   $new_op = 'do_nojs';
+  $init_message = Xss::filter($current_set['init_message']);
+  // Tweak init_message to avoid the bottom of the page flickering down after
+  // init phase.
+  $init_message .= '<br/>&nbsp;';
 
   if (!isset($batch['running'])) {
     // This is the first page so we return some output immediately.
     $percentage       = 0;
-    $message          = $current_set['init_message'];
+    $message          = $init_message;
     $label            = '';
     $batch['running'] = TRUE;
   }
@@ -150,6 +155,7 @@ function _batch_progress_page() {
 
     // Perform actual processing.
     list($percentage, $message, $label) = _batch_process($batch);
+    $message = Xss::filter($message);
     if ($percentage == 100) {
       $new_op = 'finished';
     }
@@ -170,7 +176,7 @@ function _batch_progress_page() {
   $build = array(
     '#theme' => 'progress_bar',
     '#percent' => $percentage,
-    '#message' => $message,
+    '#message' => array('#markup' => $message),
     '#label' => $label,
     '#attached' => array(
       'html_head' => array(
@@ -191,7 +197,7 @@ function _batch_progress_page() {
       'drupalSettings' => [
         'batch' => [
           'errorMessage' => $current_set['error_message'] . '<br />' . $batch['error_message'],
-          'initMessage' => $current_set['init_message'],
+          'initMessage' => $init_message,
           'uri' => $url,
         ],
       ],
diff --git a/core/includes/form.inc b/core/includes/form.inc
index 65fdc40..949b013 100644
--- a/core/includes/form.inc
+++ b/core/includes/form.inc
@@ -741,10 +741,6 @@ function batch_set($batch_definition) {
     );
     $batch_set = $init + $batch_definition + $defaults;
 
-    // Tweak init_message to avoid the bottom of the page flickering down after
-    // init phase.
-    $batch_set['init_message'] .= '<br/>&nbsp;';
-
     // The non-concurrent workflow of batch execution allows us to save
     // numberOfItems() queries by handling our own counter.
     $batch_set['total'] = count($batch_set['operations']);