diff --git a/erpnext/manufacturing/doctype/bom/bom.js b/erpnext/manufacturing/doctype/bom/bom.js
index 7a002da2fac..17e9e2caeec 100644
--- a/erpnext/manufacturing/doctype/bom/bom.js
+++ b/erpnext/manufacturing/doctype/bom/bom.js
@@ -309,7 +309,9 @@ frappe.ui.form.on("BOM", {
frm.set_intro(
__("This is a Template BOM and will be used to make the work order for {0} of the item {1}", [
`variants`,
- `${frm.doc.item}`,
+ `${frappe.utils.escape_html(
+ frm.doc.item
+ )}`,
]),
true
);
diff --git a/erpnext/stock/doctype/item/item.js b/erpnext/stock/doctype/item/item.js
index 6d96cb92d59..94e70b8e818 100644
--- a/erpnext/stock/doctype/item/item.js
+++ b/erpnext/stock/doctype/item/item.js
@@ -290,7 +290,10 @@ frappe.ui.form.on("Item", {
if (frm.doc.variant_of) {
frm.set_intro(
__("This Item is a Variant of {0} (Template).", [
- `${frm.doc.variant_of}`,
+ `${frappe.utils.escape_html(frm.doc.variant_of)}`,
]),
true
);
diff --git a/erpnext/stock/doctype/shipment/shipment.js b/erpnext/stock/doctype/shipment/shipment.js
index 2672bdd1d73..95d701aa91e 100644
--- a/erpnext/stock/doctype/shipment/shipment.js
+++ b/erpnext/stock/doctype/shipment/shipment.js
@@ -174,7 +174,10 @@ frappe.ui.form.on("Shipment", {
__("Email or Phone/Mobile of the Contact are mandatory to continue.") +
"" +
__("Please set Email/Phone for the contact") +
- ` ${contact_name}`
+ ` ${frappe.utils.escape_html(contact_name)}`
);
}
let contact_display = r.message.contact_display;