Cross-site scripting (XSS) patterns can be submitted

Question

Cross-site scripting (XSS) patterns can be submitted.

 [HttpPost]
 [AllowAnonymous]
 [ValidateInput(false)]
 public async Task<string> Index(string Xml) => await Process(Xml);

If i remove ValidateInput(false) Tag it throws exception. "Potential Dangerous...."

Web.config setting as below

<httpRuntime targetFramework="4.6.1" requestValidationMode="2.0" />

The incoming request will always have XML string.

Is there any attribute or something which do not require to add validateInput(False) and allow XMl.

Please provide you input.

Thank you in advance.