Node field not sanitize on render I have a form for users who want to add new content on my Drupal 8 website.
I render node field on a twig template :

{{ node_field_title.value }}

But field are not sanitized by Drupal. Is it the normal behaviour ?

--> If the title is &lt;script&gt;alert('XSS problem!')&lt;/script&gt; the script will be executed.

Drupal 8 documentation says : 'The Twig theme engine now auto escapes everything by default. That means that every string printed from a Twig template (e.g. anything between {{ }}) gets automatically sanitized if no filters are used.'
It seems that there is no autoescaping, at least for Drupal 8.7.3 which the version I tested.
For example:  

{{ "&lt;div&gt;Is this escaped?&lt;/div&gt;" }}
{{ "&lt;script&gt;alert('NOO!');&lt;/script&gt; "}}


These lines are not escaped by default. However:

{{ "&lt;div&gt;Is this escaped?&lt;/div&gt;"|escape }}
{{ "&lt;script&gt;alert('NOO!');&lt;/script&gt;"|escape}}


These are escaped, so better be safe than sorry and use |escape for the input you're getting from your users.