Custom caption with tokens doesn't render HTML characters

The DOMPurify library solves the problem for captions on Colorbox itself, but not for HTML Title tag within <img>, it still renders as & which wouldn't be the problem if Title wasn't rendered at all because it is disabled in the image field setting, but somehow Colorbox overrides and forces it.

I was able to replicate the error you mentioned in a local environment, as shown in the screenshots below:

Alternative text configuration

Sourcecode without entity

Alt text without entity

To address this, I added \Drupal\Component\Utility\Html::decodeEntities to Xss::filter($caption) in the _colorbox_formatter_get_caption function located in web/modules/contrib/colorbox/colorbox.theme.inc. I also committed this solution to the 3469260-custom-caption-with-tokens branch.

After clearing the cache, the updated results can be seen in the following screenshots:

Source code with entity

I am submitting the ticket for review and am available for any suggestions or feedback.

Thanks for documenting and fixing this issue. Merging the MR.