From 09eae9886aae6cf25f5360d897e71f5533fd169d Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Tue, 18 Aug 2026 22:49:41 +0530
Subject: [PATCH] fix: escape activity type in project dashboard template

---
 erpnext/projects/doctype/project/project_dashboard.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/erpnext/projects/doctype/project/project_dashboard.html b/erpnext/projects/doctype/project/project_dashboard.html
index 1f299e30833..d8467317582 100644
--- a/erpnext/projects/doctype/project/project_dashboard.html
+++ b/erpnext/projects/doctype/project/project_dashboard.html
@@ -3,7 +3,7 @@
 {% for d in data %}
 <div class="row">
 	<div class="col-xs-4">
-		<a class="small time-sheet-link" data-activity_type="{{ d.activity_type || "" }}">
+		<a class="small time-sheet-link" data-activity_type="{{ frappe.utils.escape_html(d.activity_type || "") }}">
 			{{ d.activity_type || __("Unknown") }}</a>
 	</div>
 	<div class="col-xs-8">