From 09e1c6024d8ccba49921a3507704d77ce039bb92 Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Wed, 19 Aug 2026 02:06:20 +0530
Subject: [PATCH] fix: escape project name and task subject in project portal
 templates

---
 erpnext/templates/includes/projects/project_row.html   | 2 +-
 erpnext/templates/includes/projects/project_tasks.html | 2 +-
 erpnext/templates/pages/projects.html                  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/erpnext/templates/includes/projects/project_row.html b/erpnext/templates/includes/projects/project_row.html
index b0a9a276f2a..1d131314d9f 100644
--- a/erpnext/templates/includes/projects/project_row.html
+++ b/erpnext/templates/includes/projects/project_row.html
@@ -6,7 +6,7 @@
         {{ doc.name }}
       </div>
       <div class="col-xs-2 project-name">
-        {{ doc.project_name }}
+        {{ doc.project_name | e }}
       </div>
       <div class="col-xs-3 text-center">
         {% if doc.percent_complete %}
diff --git a/erpnext/templates/includes/projects/project_tasks.html b/erpnext/templates/includes/projects/project_tasks.html
index c1f9cc16112..455fc25488b 100644
--- a/erpnext/templates/includes/projects/project_tasks.html
+++ b/erpnext/templates/includes/projects/project_tasks.html
@@ -8,7 +8,7 @@
           <svg class="icon icon-xs"><use href="#icon-corner-down-right"></use></svg>
         </span>
       {% endif %}
-      {{ task.subject }}</a>
+      {{ task.subject | e }}</a>
   </div>
   <div class="col-sm-2">{{ task.status }}</div>
   <div class="col-sm-2 small text-muted">
diff --git a/erpnext/templates/pages/projects.html b/erpnext/templates/pages/projects.html
index 10466a6cb2f..2b55679fa71 100644
--- a/erpnext/templates/pages/projects.html
+++ b/erpnext/templates/pages/projects.html
@@ -1,7 +1,7 @@
 {% extends "templates/web.html" %}
 
 {% block title %}
-  {{ doc.project_name }}
+  {{ doc.project_name | e }}
 {% endblock %}
 
 {% block head_include %}
@@ -9,7 +9,7 @@
 {% endblock %}
 
 {% block header %}
-  <h3 class="my-account-header">{{ doc.project_name }}</h3>
+  <h3 class="my-account-header">{{ doc.project_name | e }}</h3>
 {% endblock %}
 
 {% block style %}