Issue #3191623: Views aggregate queries do not escape the fields

core/lib/Drupal/Core/Database/Query/Select.php

@@ -878,7 +878,10 @@ public function __toString() {
 
     // GROUP BY
     if ($this->group) {
-      $query .= "\nGROUP BY " . implode(', ', $this->group);
+      $group_by_fields = array_map(function (string $field): string {
+        return $this->connection->escapeField($field);
+      }, $this->group);
+      $query .= "\nGROUP BY " . implode(', ', $group_by_fields);
     }
 
     // HAVING