diff --git a/src/Codeception/Util/JsonArray.php b/src/Codeception/Util/JsonArray.php
index 7873c3bdab..8cac07f2df 100644
--- a/src/Codeception/Util/JsonArray.php
+++ b/src/Codeception/Util/JsonArray.php
@@ -211,7 +211,7 @@ private function arrayToXml(\DOMDocument $doc, \DOMNode $node, $array)
             if (is_array($value)) {
                 $this->arrayToXml($doc, $subNode, $value);
             } else {
-                $subNode->nodeValue = (string)$value;
+                $subNode->nodeValue = htmlspecialchars((string)$value);
             }
         }
     }
diff --git a/tests/unit/Codeception/Module/RestTest.php b/tests/unit/Codeception/Module/RestTest.php
index 6848d9d771..8053628fcc 100644
--- a/tests/unit/Codeception/Module/RestTest.php
+++ b/tests/unit/Codeception/Module/RestTest.php
@@ -241,6 +241,16 @@ public function testArrayJsonPathAndXPath()
         $this->module->dontSeeResponseJsonMatchesJsonPath('$[*].profile');
     }
 
+    /**
+     * @Issue https://github.com/Codeception/Codeception/issues/2775
+     */
+    public function testSeeResponseJsonMatchesXPathWorksWithAmpersand()
+    {
+        $this->setStubResponse('{ "product":[ { "category":[ { "comment":"something & something" } ] } ] }');
+        $this->module->seeResponseIsJson();
+        $this->module->seeResponseJsonMatchesXpath('//comment');
+    }
+
     
     public function testArrayJsonPathFails()
     {