The xss / filterXSS library (~550 lines of bundled CSS-property whitelist and HTML parser code) has been removed from the CLI bundle. Any HTML sanitization that still occurs uses simpler inline escaping (CRr() at line ~161643 for &, <, >, ", ').
Evidence
Removed BZ6, UZ6, ucK, UcK, s58, t58, QZ6, flK, cZ6 modules (search for "filterXSS" — absent from new version)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.