From 2d387002d93665d63ddf319d2896c3654c5c770c Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Sun, 2 Aug 2026 13:22:41 +0530
Subject: [PATCH] fix(workstation): escape data on `get_workstations`

---
 erpnext/manufacturing/doctype/workstation/workstation.py | 2 +-
 erpnext/public/js/plant_floor_visual/visual_plant.js     | 2 +-
 .../public/js/templates/visual_plant_floor_template.html | 9 +++++----
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/erpnext/manufacturing/doctype/workstation/workstation.py b/erpnext/manufacturing/doctype/workstation/workstation.py
index f89e7700db6..6d3c184fdef 100644
--- a/erpnext/manufacturing/doctype/workstation/workstation.py
+++ b/erpnext/manufacturing/doctype/workstation/workstation.py
@@ -457,7 +457,7 @@ def get_workstations(**kwargs):
 		d.color = color_map.get(d.status, "red")
 		d.workstation_link = get_url_to_form("Workstation", d.name)
 		if d.status != "Production":
-			d.status_image = d.off_status_image
+			d.status_image = frappe.utils.escape_html(d.off_status_image)
 			d.workstation_off = "workstation-off"
 
 	return data
diff --git a/erpnext/public/js/plant_floor_visual/visual_plant.js b/erpnext/public/js/plant_floor_visual/visual_plant.js
index de85680a6db..e029e8427b1 100644
--- a/erpnext/public/js/plant_floor_visual/visual_plant.js
+++ b/erpnext/public/js/plant_floor_visual/visual_plant.js
@@ -176,7 +176,7 @@ class VisualPlantFloor {
 				.find(".workstation-image-container")
 				.append(
 					`<div class="workstation-image-cls workstation-abbr" style="margin:6px; height:82px">${frappe.get_abbr(
-						data.name,
+						frappe.utils.escape_html(data.name),
 						2
 					)}</div>`
 				);
diff --git a/erpnext/public/js/templates/visual_plant_floor_template.html b/erpnext/public/js/templates/visual_plant_floor_template.html
index 9e4e867fcc2..96efcc3a1a8 100644
--- a/erpnext/public/js/templates/visual_plant_floor_template.html
+++ b/erpnext/public/js/templates/visual_plant_floor_template.html
@@ -1,5 +1,6 @@
 {% $.each(workstations, (idx, row) => { %}
-	<div class="workstation-wrapper" data-workstation="{{row.name}}">
+	{% const row_workstation_name = frappe.utils.escape_html(row.name); %}
+	<div class="workstation-wrapper" data-workstation="{{row_workstation_name}}">
 		<div class="workstation-status text-left" style="">
 			<span class="indicator-pill no-indicator-dot whitespace-nowrap {{row.color}}" style="margin: 8px 0px 0px 8px;">
 				<span class="workstation-status-title" style="font-size:10px">{{row.status}}</span>
@@ -10,12 +11,12 @@
 				{% if(row.status_image) { %}
 					<img class="workstation-image-cls" src="{{row.status_image}}">
 				{% } else { %}
-					<div class="workstation-image-cls workstation-abbr" style="margin:6px; height:82px">{{frappe.get_abbr(row.name, 2)}}</div>
+					<div class="workstation-image-cls workstation-abbr" style="margin:6px; height:82px">{{frappe.get_abbr(row_workstation_name, 2)}}</div>
 				{% } %}
 			</div>
-			<span class="ellipsis" title="{{row.name}}">
+			<span class="ellipsis" title="{{row_workstation_name}}">
 				<div style="font-size:11px; text-align:center;padding-bottom:8px">{{row.workstation_name}}</div>
 			</span>
 		</div>
 	</div>
-{% }); %}
\ No newline at end of file
+{% }); %}