fix: escape value in multiselect pill (#25516)

frappe · Mar 18, 2024 · d7f82bc · d7f82bc
1 parent a87948b
commit d7f82bc
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/frappe/public/js/frappe/form/controls/multiselect_pills.js b/frappe/public/js/frappe/form/controls/multiselect_pills.js
@@ -91,7 +91,7 @@ frappe.ui.form.ControlMultiSelectPills = class ControlMultiSelectPills extends (
 		const encoded_value = encodeURIComponent(value);
 		return `
 			<button class="data-pill btn tb-selected-value" data-value="${encoded_value}">
-				<span class="btn-link-to-form">${__(label || value)}</span>
+				<span class="btn-link-to-form">${__(label || frappe.utils.escape_html(value))}</span>
 				<span class="btn-remove">${frappe.utils.icon("close")}</span>
 			</button>
 		`;