diff --git a/erpnext/manufacturing/report/production_plan_summary/production_plan_summary.js b/erpnext/manufacturing/report/production_plan_summary/production_plan_summary.js
index 0e89a25c228..8536ccd1993 100644
--- a/erpnext/manufacturing/report/production_plan_summary/production_plan_summary.js
+++ b/erpnext/manufacturing/report/production_plan_summary/production_plan_summary.js
@@ -23,7 +23,10 @@ frappe.query_reports["Production Plan Summary"] = {
if (column.fieldname == "item_code") {
var color = data.pending_qty > 0 ? "red" : "green";
- value = `${data["item_code"]}`;
+ value = `${frappe.utils.escape_html(data["item_code"])}`;
}
return value;
diff --git a/erpnext/stock/report/serial_no_and_batch_traceability/serial_no_and_batch_traceability.js b/erpnext/stock/report/serial_no_and_batch_traceability/serial_no_and_batch_traceability.js
index 59cb2eb6545..d17b38d7f8f 100644
--- a/erpnext/stock/report/serial_no_and_batch_traceability/serial_no_and_batch_traceability.js
+++ b/erpnext/stock/report/serial_no_and_batch_traceability/serial_no_and_batch_traceability.js
@@ -68,7 +68,7 @@ frappe.query_reports["Serial No and Batch Traceability"] = {
function getTraceabilityLink({ type, value, original_value, item_code, data, filter_values }) {
if (!value) return value;
- const base_url = type === "batch_no" ? "/app/batch/" : "/app/serial-no/";
+ const link_doctype = type === "batch_no" ? "Batch" : "Serial No";
const filter_list = filter_values[type]; // either batches or serial_nos
let css_class = "ellipsis";
@@ -84,7 +84,10 @@ function getTraceabilityLink({ type, value, original_value, item_code, data, fil
css_class = data.direction === "Backward" ? "ellipsis text-success" : "ellipsis text-danger";
}
- return `${original_value}`;
+ return `${frappe.utils.escape_html(original_value)}`;
}
function custom_formatter(value, row, column, data, default_formatter) {