Issue #1889376 by Wim Leers, grisendo: Fixed Field label not sanitized.

core/modules/edit/lib/Drupal/edit/MetadataGenerator.php

@@ -80,7 +80,7 @@ public function generate(EntityInterface $entity, FieldInstance $instance, $lang
     $label = $instance['label'];
     $editor = $this->editorManager->createInstance($editor_id);
     $metadata = array(
-      'label' => $label,
+      'label' => check_plain($label),
       'access' => TRUE,
       'editor' => $editor_id,
       'aria' => t('Entity @type @id, field @field', array('@type' => $entity->entityType(), '@id' => $entity->id(), '@field' => $label)),