From 449c90f05f6e76a0eb5b43e656ef290ee2632e48 Mon Sep 17 00:00:00 2001
From: diptanilsaha <diptanil@frappe.io>
Date: Wed, 19 Aug 2026 02:06:24 +0530
Subject: [PATCH] fix: escape event subject in crm activities template

---
 erpnext/public/js/templates/crm_activities.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/erpnext/public/js/templates/crm_activities.html b/erpnext/public/js/templates/crm_activities.html
index 683f3011409..0d32e89cd94 100644
--- a/erpnext/public/js/templates/crm_activities.html
+++ b/erpnext/public/js/templates/crm_activities.html
@@ -115,7 +115,7 @@
                                     </svg>
                                 </span>
                                 <a href="/app/event/{{ frappe.utils.escape_html(events[i].name) }}" title="{{ __('Open Event') }}">
-                                    {%= events[i].subject %}
+                                    {%= frappe.utils.escape_html(events[i].subject) %}
                                 </a>
                             </div>
                             <div class="checkbox">
@@ -162,7 +162,7 @@
 							</svg>
 						</span>
 						<a href="/app/event/{{ frappe.utils.escape_html(event.name) }}" title="{{ __('Open Event') }}">
-							{%= event.subject %}
+							{%= frappe.utils.escape_html(event.subject) %}
 						</a>
 					</div>
 					<div class="checkbox">