diff -u b/core/modules/filter/src/Plugin/Filter/FilterCaption.php b/core/modules/filter/src/Plugin/Filter/FilterCaption.php
--- b/core/modules/filter/src/Plugin/Filter/FilterCaption.php
+++ b/core/modules/filter/src/Plugin/Filter/FilterCaption.php
@@ -60,6 +60,9 @@
         $node->removeAttribute('class');
         $filter_caption = array(
           '#theme' => 'filter_caption',
+          // We pass the unsanitized string because this is a text format
+          // filter, and after filtering, we always assume the output is safe.
+          // @see \Drupal\filter\Element\ProcessedText::preRenderText()
           '#node' => SafeString::create($node->C14N()),
           '#tag' => $node->tagName,
           '#caption' => $caption,