diff --git a/templates/servers.html b/templates/servers.html
index 74955a6..debeb13 100644
--- a/templates/servers.html
+++ b/templates/servers.html
@@ -80,6 +80,10 @@ Servers
             const listenPort = obj.Interface ? obj.Interface.listen_port : "";
             const interfaceName = obj.Interface ? obj.Interface.name : "";
 
+            // obj.id/interfaceName are server-side validated against [a-zA-Z0-9_-],
+            // safe to interpolate; obj.name is free text and must be escaped.
+            const safeName = $('<div>').text(obj.name).html();
+
             let html = `<div class="col-sm-6 col-md-6 col-lg-4" id="server_${obj.id}">
                             <div class="info-box">
                                 <div class="info-box-content">
@@ -87,7 +91,7 @@ Servers
                                         <a href="{{.basePath}}/servers/${obj.id}/clients" class="btn btn-outline-primary btn-sm">Manage clients</a>
                                     </div>
                                     <hr>
-                                    <span class="info-box-text"><i class="fas fa-server"></i> ${obj.name}</span>
+                                    <span class="info-box-text"><i class="fas fa-server"></i> ${safeName}</span>
                                     <span class="info-box-text"><i class="fas fa-fingerprint"></i> ID: ${obj.id}</span>
                                     <span class="info-box-text"><i class="fas fa-ethernet"></i> Interface: ${interfaceName}</span>
                                     <span class="info-box-text"><i class="fas fa-plug"></i> Listen Port: ${listenPort}</span>