From 5f5ebce1c34ace11e4c02bbe9244f2cc64a085db Mon Sep 17 00:00:00 2001
From: brandonkelly <brandon@pixelandtonic.com>
Date: Wed, 12 Aug 2026 11:37:04 -0700
Subject: [PATCH 1/2] Allow safe HTML in Markdown field layout elements

---
 src/Form/Nodes/MarkdownContent.php                    | 3 ++-
 tests/Feature/FieldLayout/FieldLayoutCompilerTest.php | 4 ++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/Form/Nodes/MarkdownContent.php b/src/Form/Nodes/MarkdownContent.php
index 0e703eda629..134fea3b186 100644
--- a/src/Form/Nodes/MarkdownContent.php
+++ b/src/Form/Nodes/MarkdownContent.php
@@ -9,6 +9,7 @@
 use CraftCms\Cms\Form\FormHtmlRenderer;
 use CraftCms\Cms\Form\FormPayload;
 use CraftCms\Cms\Form\NodePayload;
+use CraftCms\Cms\Support\Facades\HtmlSanitizers;
 use CraftCms\Cms\Support\Facades\Markdown;
 use CraftCms\Cms\Support\Html;
 
@@ -39,7 +40,7 @@ public static function make(string $uid, string $content): self
     {
         return new self(
             $uid,
-            Markdown::parse(Html::encode($content), 'pre-encoded'),
+            HtmlSanitizers::sanitize(Markdown::parse($content)),
         );
     }
 
diff --git a/tests/Feature/FieldLayout/FieldLayoutCompilerTest.php b/tests/Feature/FieldLayout/FieldLayoutCompilerTest.php
index 0e475798706..8b80e39270c 100644
--- a/tests/Feature/FieldLayout/FieldLayoutCompilerTest.php
+++ b/tests/Feature/FieldLayout/FieldLayoutCompilerTest.php
@@ -57,7 +57,7 @@ function persistedEntryLayout(): FieldLayoutModel
             ]),
             new Markdown([
                 'uid' => 'content-note',
-                'content' => '<script>alert(1)</script> **Editorial note**',
+                'content' => "<script>alert(1)</script>\n\n**Editorial note**",
                 'displayInPane' => false,
                 'width' => 50,
             ]),
@@ -123,8 +123,8 @@ function persistedEntryLayout(): FieldLayoutModel
             'width' => 50,
         ])
         ->and($content->filter('script'))->toHaveCount(0)
+        ->and($content->text())->not->toContain('alert(1)')
         ->and($content->filter('strong')->text())->toBe('Editorial note')
-        ->and($content->text())->toContain('<script>alert(1)</script>')
         ->and($payload->values)->toBe(['title' => 'Persisted title'])
         ->and($payload->errors)->toBe([[
             'path' => ['title'],

From 04328c87f233fa851e492c2e4b3888d556c81c95 Mon Sep 17 00:00:00 2001
From: brandonkelly <brandon@pixelandtonic.com>
Date: Wed, 12 Aug 2026 11:40:40 -0700
Subject: [PATCH 2/2] Release note

[ci skip]
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8760efb5d16..d9b47709a67 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- Safe HTML elements are now allowed within Markdown field layout elements. ([#19426](https://github.com/craftcms/cms/pull/19426))
 - Added a slideout system for the Inertia/Vue Control Panel, which renders any `CpScreenResponse`-based screen as an in-page panel from a normal Inertia response, alongside the existing legacy `Craft.CpScreenSlideout`. ([#19354](https://github.com/craftcms/cms/pull/19354))
 - Added `CraftCms\Cms\Http\Responses\CpScreenResponse::screenData()`. ([#19354](https://github.com/craftcms/cms/pull/19354))
 - Removed the `Pane.vue` Vue component in favor of the `craft-pane` web component. ([#19398](https://github.com/craftcms/cms/pull/19398))