Ticket #23664: 23664.patch

wp-includes/theme.php

@@ -986 +986 @@
  * @since 2.1.0
  */
 function header_image() {
-        echo get_header_image();
+        echo esc_url( get_header_image() );
 }
 
 /**