diff --git a/frontend/src/components/common/notice-item.js b/frontend/src/components/common/notice-item.js
index 57cad6515b..71dd5ff39b 100644
--- a/frontend/src/components/common/notice-item.js
+++ b/frontend/src/components/common/notice-item.js
@@ -41,14 +41,13 @@ class NoticeItem extends React.Component {
       let groupStaff = detail.group_staff_name;
 
       // group name does not support special characters
-      let userHref = siteRoot + 'profile/' + detail.group_staff_email + '/';
+      let userHref = siteRoot + 'profile/' + encodeURIComponent(detail.group_staff_email) + '/';
       let groupHref = siteRoot + 'group/' + detail.group_id + '/';
       let groupName = detail.group_name;
 
       let notice = gettext('User {user_link} has added you to {group_link}');
-      let userLink = '<a href=' + userHref + '>' + groupStaff + '</a>';
-      let groupLink = '<a href=' + groupHref + '>' + groupName + '</a>';
-
+      let userLink = '<a href=' + userHref + '>' + Utils.HTMLescape(groupStaff) + '</a>';
+      let groupLink = '<a href=' + groupHref + '>' + Utils.HTMLescape(groupName) + '</a>';
       notice = notice.replace('{user_link}', userLink);
       notice = notice.replace('{group_link}', groupLink);
 
diff --git a/frontend/src/pages/dashboard/activity-item.js b/frontend/src/pages/dashboard/activity-item.js
index 8de5ef0179..ad9af5c3b6 100644
--- a/frontend/src/pages/dashboard/activity-item.js
+++ b/frontend/src/pages/dashboard/activity-item.js
@@ -90,7 +90,7 @@ class ActivityItem extends Component {
       }
     } else if (item.obj_type == 'files') {
       let fileURL = `${siteRoot}lib/${item.repo_id}/file${Utils.encodePath(item.path)}`;
-      let fileLink = `<a href=${fileURL} target="_blank">${item.name}</a>`;
+      let fileLink = `<a href=${fileURL} target="_blank">${Utils.HTMLescape(item.name)}</a>`;
       let fileCount = item.createdFilesCount - 1;
       let firstLine = gettext('{file} and {n} other files')
         .replace('{file}', fileLink)
diff --git a/frontend/src/pages/sys-admin/admin-logs/operation-logs.js b/frontend/src/pages/sys-admin/admin-logs/operation-logs.js
index ff49bde5b7..2644db236b 100644
--- a/frontend/src/pages/sys-admin/admin-logs/operation-logs.js
+++ b/frontend/src/pages/sys-admin/admin-logs/operation-logs.js
@@ -138,15 +138,15 @@ class Item extends Component {
         detailText = gettext('Created library {library_name} with {owner} as its owner')
           .replace('{owner}', '<a href="' + ownerPageUrl + '">' + detail.owner + '</a>');
         if (isPro && enableSysAdminViewRepo) {
-          detailText = detailText.replace('{library_name}', '<a href="' + repoPageUrl + '">' + detail.name + '</a>');
+          detailText = detailText.replace('{library_name}', '<a href="' + repoPageUrl + '">' + Utils.HTMLescape(detail.name) + '</a>');
         } else {
-          detailText = detailText.replace('{library_name}', '<span class="font-weight-bold">' + detail.name + '</span>');
+          detailText = detailText.replace('{library_name}', '<span class="font-weight-bold">' + Utils.HTMLescape(detail.name) + '</span>');
         }
         return detailText;
 
       case 'repo_delete':
         detailText = gettext('Deleted library {library_name}')
-          .replace('{library_name}', '<span class="font-weight-bold">' + detail.name + '</span>');
+          .replace('{library_name}', '<span class="font-weight-bold">' + Utils.HTMLescape(detail.name) + '</span>');
         return detailText;
 
       case 'repo_transfer':
@@ -154,9 +154,9 @@ class Item extends Component {
           .replace('{user_from}', '<span class="font-weight-bold">' + detail.from + '</span>')
           .replace('{user_to}', '<span class="font-weight-bold">' + detail.to + '</span>');
         if (isPro && enableSysAdminViewRepo) {
-          detailText = detailText.replace('{library_name}', '<a href="' + repoPageUrl + '">' + detail.name + '</a>');
+          detailText = detailText.replace('{library_name}', '<a href="' + repoPageUrl + '">' + Utils.HTMLescape(detail.name) + '</a>');
         } else {
-          detailText = detailText.replace('{library_name}', '<span class="font-weight-bold">' + detail.name + '</span>');
+          detailText = detailText.replace('{library_name}', '<span class="font-weight-bold">' + Utils.HTMLescape(detail.name) + '</span>');
         }
         return detailText;