diff --git a/bskylink/src/html/linkRedirectContents.ts b/bskylink/src/html/linkRedirectContents.ts
index a3d31de50e..f387963ea4 100644
--- a/bskylink/src/html/linkRedirectContents.ts
+++ b/bskylink/src/html/linkRedirectContents.ts
@@ -1,10 +1,11 @@
+import escapeHTML from 'escape-html'
 import {type Hole, html} from 'uhtml'
 
 export function linkRedirectContents(link: string): Hole {
   return html`
     <html>
       <head>
-        <meta http-equiv="refresh" content="0; URL='${link}'" />
+        <meta http-equiv="refresh" content="0; URL='${escapeHTML(link)}'" />
         <meta
           http-equiv="Cache-Control"
           content="no-store, no-cache, must-revalidate, max-age=0" />
diff --git a/bskylink/src/html/linkWarningContents.ts b/bskylink/src/html/linkWarningContents.ts
index 70b91ea23a..d55f085870 100644
--- a/bskylink/src/html/linkWarningContents.ts
+++ b/bskylink/src/html/linkWarningContents.ts
@@ -1,3 +1,4 @@
+import escapeHTML from 'escape-html'
 import {type Hole, html} from 'uhtml'
 
 export function linkWarningContents(opts: {
@@ -15,11 +16,11 @@ export function linkWarningContents(opts: {
         : 'This link has been identified as malicious and has blocked for your safety.'}
     </p>
     <div class="blocked-site">
-      <p class="site-url">${opts.link}</p>
+      <p class="site-url">${escapeHTML(opts.link)}</p>
     </div>
     <div class="button-group">
       ${opts.type === 'warn'
-        ? html`<a class="button secondary" href="${opts.link}"
+        ? html`<a class="button secondary" href="${escapeHTML(opts.link)}"
             >Continue Anyway</a
           >`
         : null}
diff --git a/bskylink/src/html/linkWarningLayout.ts b/bskylink/src/html/linkWarningLayout.ts
index cc5c4d4ac9..be4e10a9d6 100644
--- a/bskylink/src/html/linkWarningLayout.ts
+++ b/bskylink/src/html/linkWarningLayout.ts
@@ -1,3 +1,4 @@
+import escapeHTML from 'escape-html'
 import {type Hole, html} from 'uhtml'
 
 export function linkWarningLayout(
@@ -15,7 +16,7 @@ export function linkWarningLayout(
         <meta http-equiv="Pragma" content="no-cache" />
         <meta http-equiv="Expires" content="0" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-        <title>${title}</title>
+        <title>${escapeHTML(title)}</title>
         <style>
           * {
             margin: 0;
