XSS vulnerability on paragraph bundle name (overview page)

The paragraphs-module correctly sanitizes/escapes the bundle names almost everywhere, except on the paragraph bundle overview page, where script- or other tags embedded in the bundle name are executed/included as markup.

(posted publicly with maintainer's approval)