diff --git a/core/modules/comment/src/Tests/CommentTokenReplaceTest.php b/core/modules/comment/src/Tests/CommentTokenReplaceTest.php
index 4cb427b..f4df9a6 100644
--- a/core/modules/comment/src/Tests/CommentTokenReplaceTest.php
+++ b/core/modules/comment/src/Tests/CommentTokenReplaceTest.php
@@ -38,7 +38,7 @@ function testCommentTokenReplacement() {
     $this->setCommentSubject(TRUE);
 
     // Create a node and a comment.
-    $node = $this->drupalCreateNode(array('type' => 'article'));
+    $node = $this->drupalCreateNode(array('type' => 'article', 'title' => '<script>alert("123")</script>'));
     $parent_comment = $this->postComment($node, $this->randomMachineName(), $this->randomMachineName(), TRUE);
 
     // Post a reply to the comment.
@@ -56,7 +56,7 @@ function testCommentTokenReplacement() {
     $tests['[comment:hostname]'] = $comment->getHostname();
     $tests['[comment:author]'] = Html::escape($comment->getAuthorName());
     $tests['[comment:mail]'] = $this->adminUser->getEmail();
-    $tests['[comment:homepage]'] = $comment->getHomepage();
+    $tests['[comment:homepage]'] = Html::escape($comment->getHomepage());
     $tests['[comment:title]'] = Html::escape($comment->getSubject());
     $tests['[comment:body]'] = $comment->comment_body->processed;
     $tests['[comment:langcode]'] = $comment->language()->getId();
@@ -67,12 +67,12 @@ function testCommentTokenReplacement() {
     $tests['[comment:changed:since]'] = \Drupal::service('date.formatter')->formatTimeDiffSince($comment->getChangedTimeAcrossTranslations(), array('langcode' => $language_interface->getId()));
     $tests['[comment:parent:cid]'] = $comment->hasParentComment() ? $comment->getParentComment()->id() : NULL;
     $tests['[comment:parent:title]'] = $parent_comment->getSubject();
-    $tests['[comment:entity]'] = $node->getTitle();
+    $tests['[comment:entity]'] = Html::escape($node->getTitle());
     // Test node specific tokens.
     $tests['[comment:entity:nid]'] = $comment->getCommentedEntityId();
-    $tests['[comment:entity:title]'] = $node->getTitle();
+    $tests['[comment:entity:title]'] = Html::escape($node->getTitle());
     $tests['[comment:author:uid]'] = $comment->getOwnerId();
-    $tests['[comment:author:name]'] = $this->adminUser->getUsername();
+    $tests['[comment:author:name]'] = Html::escape($this->adminUser->getUsername());
 
     $base_bubbleable_metadata = BubbleableMetadata::createFromObject($comment);
     $metadata_tests = [];
diff --git a/core/tests/Drupal/Tests/Core/Utility/TokenTest.php b/core/tests/Drupal/Tests/Core/Utility/TokenTest.php
index af5a59e..7ab46a9 100644
--- a/core/tests/Drupal/Tests/Core/Utility/TokenTest.php
+++ b/core/tests/Drupal/Tests/Core/Utility/TokenTest.php
@@ -300,6 +300,11 @@ public function providerTestReplaceEscaping() {
       ['[token:meh]' => '" onclick=alert(muh)"'],
       '<a href="&quot; onclick=alert(muh)&quot;">Giraffe</a>',
     ];
+    $data['xss-from-the-string'] = [
+      '<script>alert("123")</script>',
+      [],
+      'alert("123")',
+    ];
 
     return $data;
   }