diff --git a/spring-boot-admin-server-ui/src/main/frontend/components/sba-alert.spec.ts b/spring-boot-admin-server-ui/src/main/frontend/components/sba-alert.spec.ts
new file mode 100644
index 00000000000..73a33453bfd
--- /dev/null
+++ b/spring-boot-admin-server-ui/src/main/frontend/components/sba-alert.spec.ts
@@ -0,0 +1,67 @@
+/*
+ * Copyright 2014-2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { screen } from '@testing-library/vue';
+import { describe, expect, it } from 'vitest';
+
+import SbaAlert from '@/components/sba-alert.vue';
+
+import { render } from '@/test-utils';
+
+describe('SbaAlert', () => {
+  it('renders plain-text error messages', async () => {
+    render(SbaAlert, {
+      props: { error: 'Something went wrong' },
+    });
+
+    expect(await screen.findByText('Something went wrong')).toBeInTheDocument();
+  });
+
+  it('renders safe HTML markup contained in the error message', async () => {
+    render(SbaAlert, {
+      props: { error: 'Request failed: <strong>timeout</strong>' },
+    });
+
+    const strong = await screen.findByText('timeout');
+    expect(strong.tagName).toBe('STRONG');
+  });
+
+  it('strips script tags and event handler attributes from the error message', async () => {
+    const maliciousMessage =
+      '<img src=x onerror="window.__xss = 1"><script>window.__xss = 1</script>';
+
+    render(SbaAlert, {
+      props: { error: maliciousMessage },
+    });
+
+    await screen.findByRole('alert');
+
+    expect(document.querySelectorAll('img').length).toBe(0);
+    expect(document.querySelectorAll('script').length).toBe(0);
+    expect((window as any).__xss).toBeUndefined();
+  });
+
+  it('sanitizes Error instance messages the same way', async () => {
+    render(SbaAlert, {
+      props: {
+        error: new Error('<img src=x onerror="window.__xss = 1">boom'),
+      },
+    });
+
+    expect(await screen.findByText('boom')).toBeInTheDocument();
+    expect(document.querySelectorAll('img').length).toBe(0);
+    expect((window as any).__xss).toBeUndefined();
+  });
+});
diff --git a/spring-boot-admin-server-ui/src/main/frontend/components/sba-alert.vue b/spring-boot-admin-server-ui/src/main/frontend/components/sba-alert.vue
index 1931df93965..f24fb517e47 100644
--- a/spring-boot-admin-server-ui/src/main/frontend/components/sba-alert.vue
+++ b/spring-boot-admin-server-ui/src/main/frontend/components/sba-alert.vue
@@ -42,6 +42,8 @@ import { defineComponent } from 'vue';
 
 import FontAwesomeIcon from '@/components/font-awesome-icon';
 
+import { sanitizeHtml } from '@/utils/sanitizeHtml';
+
 export const Severity = {
   ERROR: 'ERROR',
   WARN: 'WARN',
@@ -90,10 +92,10 @@ export default defineComponent({
   computed: {
     message() {
       if (this.error instanceof Error) {
-        return this.error.message;
+        return sanitizeHtml(this.error.message);
       }
       if (typeof this.error === 'string') {
-        return this.error;
+        return sanitizeHtml(this.error);
       }
 
       return null;
diff --git a/spring-boot-admin-server-ui/src/main/frontend/views/applications/ActionHandler.spec.ts b/spring-boot-admin-server-ui/src/main/frontend/views/applications/ActionHandler.spec.ts
new file mode 100644
index 00000000000..ccf7c3dc7e1
--- /dev/null
+++ b/spring-boot-admin-server-ui/src/main/frontend/views/applications/ActionHandler.spec.ts
@@ -0,0 +1,226 @@
+/*
+ * Copyright 2014-2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { describe, expect, it, vi } from 'vitest';
+
+import {
+  ApplicationActionHandler,
+  InstanceActionHandler,
+} from '@/views/applications/ActionHandler';
+
+// A minimal translation function that mimics vue-i18n's interpolation:
+// it does NOT escape the injected {name}/{error} values, so any HTML
+// contained in them ends up verbatim in the returned string - exactly
+// like the real i18n messages that still contain literal <code> markup.
+const t = (key: string, params: Record<string, any> = {}) => {
+  const templates: Record<string, string> = {
+    'applications.actions.unregister': 'Deregister?',
+    'applications.actions.shutdown': 'Shutdown?',
+    'applications.actions.restart': 'Restart?',
+    'applications.unregister': 'Deregister application <code>{name}</code>?',
+    'applications.unregister_successful':
+      'Successfully deregistered application <code>{name}</code>.',
+    'applications.unregister_failed':
+      'Deregistration of application <code>{name}</code> failed ({error}).',
+    'applications.shutdown': 'Shutdown application <code>{name}</code>?',
+    'applications.shutdown_successful':
+      'Successfully shutdown application {name}.',
+    'applications.shutdown_failed': 'Failed to shutdown application {name}.',
+    'applications.restart': 'Restart application <code>{name}</code>?',
+    'applications.restarted':
+      'Successfully restarted application <code>{name}</code>.',
+    'applications.restart_failed':
+      'Failed to restart application {name} ({error}).',
+    'instances.unregister': 'Deregister instance <code>{name}</code>?',
+    'instances.unregister_successful':
+      'Successfully deregistered instance <code>{name}</code>.',
+    'instances.unregister_failed':
+      'Deregistration of instance <code>{name}</code> failed ({error}).',
+    'instances.shutdown': 'Shutdown instance <code>{name}</code>?',
+    'instances.shutdown_successful': 'Successfully shutdown instance {name}.',
+    'instances.shutdown_failed': 'Failed to shutdown instance {name}.',
+    'instances.restart': 'Restart instance <code>{name}</code>?',
+    'instances.restarted':
+      'Successfully restarted instance <code>{name}</code>.',
+    'instances.restart_failed': 'Failed to restart instance {name} ({error}).',
+  };
+  let result = templates[key] ?? key;
+  for (const [param, value] of Object.entries(params)) {
+    result = result.replaceAll(`{${param}}`, String(value));
+  }
+  return result;
+};
+
+function createModalStub(confirmed = true) {
+  return { confirm: vi.fn().mockResolvedValue(confirmed) };
+}
+
+function createNotificationCenterStub() {
+  return { success: vi.fn(), error: vi.fn() };
+}
+
+describe('ApplicationActionHandler', () => {
+  const maliciousName = '</code><img src=x onerror="window.__xss = 1">';
+
+  it('sanitizes the application name in the shutdown confirmation dialog', async () => {
+    const $sbaModal = createModalStub(false);
+    const notificationCenter = createNotificationCenterStub();
+    const handler = new ApplicationActionHandler(
+      $sbaModal,
+      t,
+      notificationCenter,
+    );
+
+    await handler.shutdown({ name: maliciousName } as any);
+
+    const body = $sbaModal.confirm.mock.calls[0][1];
+    expect(body).not.toContain('<img');
+    expect(body).not.toContain('onerror');
+  });
+
+  it('sanitizes the application name in the restart confirmation dialog', async () => {
+    const $sbaModal = createModalStub(false);
+    const notificationCenter = createNotificationCenterStub();
+    const handler = new ApplicationActionHandler(
+      $sbaModal,
+      t,
+      notificationCenter,
+    );
+
+    await handler.restart({ name: maliciousName } as any);
+
+    const body = $sbaModal.confirm.mock.calls[0][1];
+    expect(body).not.toContain('<img');
+    expect(body).not.toContain('onerror');
+  });
+
+  it('sanitizes the application name in the unregister confirmation dialog and success toast', async () => {
+    const $sbaModal = createModalStub(true);
+    const notificationCenter = createNotificationCenterStub();
+    const application = {
+      name: maliciousName,
+      unregister: vi.fn().mockResolvedValue(undefined),
+    };
+    const handler = new ApplicationActionHandler(
+      $sbaModal,
+      t,
+      notificationCenter,
+    );
+
+    await handler.unregister(application as any);
+
+    const confirmBody = $sbaModal.confirm.mock.calls[0][1];
+    expect(confirmBody).not.toContain('<img');
+    expect(confirmBody).not.toContain('onerror');
+
+    const successMessage = notificationCenter.success.mock.calls[0][0];
+    expect(successMessage).not.toContain('<img');
+    expect(successMessage).not.toContain('onerror');
+  });
+
+  it('sanitizes the application name in the unregister error toast', async () => {
+    const $sbaModal = createModalStub(true);
+    const notificationCenter = createNotificationCenterStub();
+    const application = {
+      name: maliciousName,
+      unregister: vi.fn().mockRejectedValue({ response: { status: 500 } }),
+    };
+    const handler = new ApplicationActionHandler(
+      $sbaModal,
+      t,
+      notificationCenter,
+    );
+
+    await handler.unregister(application as any);
+
+    const errorMessage = notificationCenter.error.mock.calls[0][0];
+    expect(errorMessage).not.toContain('<img');
+    expect(errorMessage).not.toContain('onerror');
+  });
+
+  it('preserves safe markup such as <code> around the sanitized name', async () => {
+    const $sbaModal = createModalStub(false);
+    const notificationCenter = createNotificationCenterStub();
+    const handler = new ApplicationActionHandler(
+      $sbaModal,
+      t,
+      notificationCenter,
+    );
+
+    await handler.shutdown({ name: 'my-app' } as any);
+
+    const body = $sbaModal.confirm.mock.calls[0][1];
+    expect(body).toBe('Shutdown application <code>my-app</code>?');
+  });
+});
+
+describe('InstanceActionHandler', () => {
+  const maliciousId = '</code><script>window.__xss = 1</script>';
+
+  it('sanitizes the instance id in the shutdown confirmation dialog', async () => {
+    const $sbaModal = createModalStub(false);
+    const notificationCenter = createNotificationCenterStub();
+    const handler = new InstanceActionHandler($sbaModal, t, notificationCenter);
+
+    await handler.shutdown({ id: maliciousId } as any);
+
+    const body = $sbaModal.confirm.mock.calls[0][1];
+    expect(body).not.toContain('<script');
+  });
+
+  it('sanitizes the instance id in the restart confirmation dialog', async () => {
+    const $sbaModal = createModalStub(false);
+    const notificationCenter = createNotificationCenterStub();
+    const handler = new InstanceActionHandler($sbaModal, t, notificationCenter);
+
+    await handler.restart({ id: maliciousId } as any);
+
+    const body = $sbaModal.confirm.mock.calls[0][1];
+    expect(body).not.toContain('<script');
+  });
+
+  it('sanitizes the instance id in the unregister confirmation dialog and success toast', async () => {
+    const $sbaModal = createModalStub(true);
+    const notificationCenter = createNotificationCenterStub();
+    const instance = {
+      id: maliciousId,
+      unregister: vi.fn().mockResolvedValue(undefined),
+    };
+    const handler = new InstanceActionHandler($sbaModal, t, notificationCenter);
+
+    await handler.unregister(instance as any);
+
+    const confirmBody = $sbaModal.confirm.mock.calls[0][1];
+    expect(confirmBody).not.toContain('<script');
+
+    const successMessage = notificationCenter.success.mock.calls[0][0];
+    expect(successMessage).not.toContain('<script');
+  });
+
+  it('sanitizes the instance id in the unregister error toast', async () => {
+    const $sbaModal = createModalStub(true);
+    const notificationCenter = createNotificationCenterStub();
+    const instance = {
+      id: maliciousId,
+      unregister: vi.fn().mockRejectedValue({ response: { status: 500 } }),
+    };
+    const handler = new InstanceActionHandler($sbaModal, t, notificationCenter);
+
+    await handler.unregister(instance as any);
+
+    const errorMessage = notificationCenter.error.mock.calls[0][0];
+    expect(errorMessage).not.toContain('<script');
+  });
+});
diff --git a/spring-boot-admin-server-ui/src/main/frontend/views/applications/ActionHandler.ts b/spring-boot-admin-server-ui/src/main/frontend/views/applications/ActionHandler.ts
index c0f280d6827..d3915135101 100644
--- a/spring-boot-admin-server-ui/src/main/frontend/views/applications/ActionHandler.ts
+++ b/spring-boot-admin-server-ui/src/main/frontend/views/applications/ActionHandler.ts
@@ -1,5 +1,6 @@
 import Application from '@/services/application';
 import Instance from '@/services/instance';
+import { sanitizeHtml } from '@/utils/sanitizeHtml';
 
 export interface ActionHandler {
   restart(item: any): Promise<void>;
@@ -19,7 +20,7 @@ export class InstanceActionHandler implements ActionHandler {
   async unregister(item: Instance) {
     const isConfirmed = await this.$sbaModal.confirm(
       this.t('applications.actions.unregister'),
-      this.t('instances.unregister', { name: item.id }),
+      sanitizeHtml(this.t('instances.unregister', { name: item.id })),
     );
     if (!isConfirmed) {
       return;
@@ -28,14 +29,18 @@ export class InstanceActionHandler implements ActionHandler {
     try {
       await item.unregister();
       this.notificationCenter.success(
-        this.t('instances.unregister_successful', { name: item.id }),
+        sanitizeHtml(
+          this.t('instances.unregister_successful', { name: item.id }),
+        ),
       );
     } catch (error) {
       this.notificationCenter.error(
-        this.t('instances.unregister_failed', {
-          name: item.id || item.name,
-          error: error.response.status,
-        }),
+        sanitizeHtml(
+          this.t('instances.unregister_failed', {
+            name: item.id || item.name,
+            error: error.response.status,
+          }),
+        ),
       );
     }
   }
@@ -43,7 +48,7 @@ export class InstanceActionHandler implements ActionHandler {
   async shutdown(item: Instance) {
     const isConfirmed = await this.$sbaModal.confirm(
       this.t('applications.actions.shutdown'),
-      this.t('instances.shutdown', { name: item.id }),
+      sanitizeHtml(this.t('instances.shutdown', { name: item.id })),
     );
     if (!isConfirmed) {
       return;
@@ -52,14 +57,18 @@ export class InstanceActionHandler implements ActionHandler {
     try {
       await item.shutdown();
       this.notificationCenter.success(
-        this.t('instances.shutdown_successful', { name: item.id }),
+        sanitizeHtml(
+          this.t('instances.shutdown_successful', { name: item.id }),
+        ),
       );
     } catch (error) {
       this.notificationCenter.error(
-        this.t('instances.shutdown_failed', {
-          name: item.id || item.name,
-          error: error.response.status,
-        }),
+        sanitizeHtml(
+          this.t('instances.shutdown_failed', {
+            name: item.id || item.name,
+            error: error.response.status,
+          }),
+        ),
       );
     }
   }
@@ -67,7 +76,7 @@ export class InstanceActionHandler implements ActionHandler {
   async restart(item: Instance) {
     const isConfirmed = await this.$sbaModal.confirm(
       this.t('applications.actions.restart'),
-      this.t('instances.restart', { name: item.id }),
+      sanitizeHtml(this.t('instances.restart', { name: item.id })),
     );
     if (!isConfirmed) {
       return;
@@ -76,14 +85,16 @@ export class InstanceActionHandler implements ActionHandler {
     try {
       await item.restart();
       this.notificationCenter.success(
-        this.t('instances.restarted', { name: item.id }),
+        sanitizeHtml(this.t('instances.restarted', { name: item.id })),
       );
     } catch (error) {
       this.notificationCenter.error(
-        this.t('instances.restart_failed', {
-          name: item.id || item.name,
-          error: error.response.status,
-        }),
+        sanitizeHtml(
+          this.t('instances.restart_failed', {
+            name: item.id || item.name,
+            error: error.response.status,
+          }),
+        ),
       );
     }
   }
@@ -99,7 +110,7 @@ export class ApplicationActionHandler implements ActionHandler {
   async restart(application: Application) {
     const isConfirmed = await this.$sbaModal.confirm(
       this.t('applications.actions.restart'),
-      this.t('applications.restart', { name: application.name }),
+      sanitizeHtml(this.t('applications.restart', { name: application.name })),
     );
     if (!isConfirmed) {
       return;
@@ -108,14 +119,18 @@ export class ApplicationActionHandler implements ActionHandler {
     try {
       await application.restart();
       this.notificationCenter.success(
-        this.t('applications.restarted', { name: application.name }),
+        sanitizeHtml(
+          this.t('applications.restarted', { name: application.name }),
+        ),
       );
     } catch (error) {
       this.notificationCenter.error(
-        this.t('applications.restart_failed', {
-          name: application.name,
-          error: error.response.status,
-        }),
+        sanitizeHtml(
+          this.t('applications.restart_failed', {
+            name: application.name,
+            error: error.response.status,
+          }),
+        ),
       );
     }
   }
@@ -123,7 +138,7 @@ export class ApplicationActionHandler implements ActionHandler {
   async shutdown(application: Application) {
     const isConfirmed = await this.$sbaModal.confirm(
       this.t('applications.actions.shutdown'),
-      this.t('applications.shutdown', { name: application.name }),
+      sanitizeHtml(this.t('applications.shutdown', { name: application.name })),
     );
     if (!isConfirmed) {
       return;
@@ -132,14 +147,20 @@ export class ApplicationActionHandler implements ActionHandler {
     try {
       await application.shutdown();
       this.notificationCenter.success(
-        this.t('applications.shutdown_successful', { name: application.name }),
+        sanitizeHtml(
+          this.t('applications.shutdown_successful', {
+            name: application.name,
+          }),
+        ),
       );
     } catch (error) {
       this.notificationCenter.error(
-        this.t('applications.shutdown_failed', {
-          name: application.name,
-          error: error.response.status,
-        }),
+        sanitizeHtml(
+          this.t('applications.shutdown_failed', {
+            name: application.name,
+            error: error.response.status,
+          }),
+        ),
       );
     }
   }
@@ -147,7 +168,9 @@ export class ApplicationActionHandler implements ActionHandler {
   async unregister(application: Application) {
     const isConfirmed = await this.$sbaModal.confirm(
       this.t('applications.actions.unregister'),
-      this.t('applications.unregister', { name: application.name }),
+      sanitizeHtml(
+        this.t('applications.unregister', { name: application.name }),
+      ),
     );
     if (!isConfirmed) {
       return;
@@ -156,16 +179,20 @@ export class ApplicationActionHandler implements ActionHandler {
     try {
       await application.unregister();
       this.notificationCenter.success(
-        this.t('applications.unregister_successful', {
-          name: application.name,
-        }),
+        sanitizeHtml(
+          this.t('applications.unregister_successful', {
+            name: application.name,
+          }),
+        ),
       );
     } catch (error) {
       this.notificationCenter.error(
-        this.t('applications.unregister_failed', {
-          name: application.name,
-          error: error.response.status,
-        }),
+        sanitizeHtml(
+          this.t('applications.unregister_failed', {
+            name: application.name,
+            error: error.response.status,
+          }),
+        ),
       );
     }
   }
diff --git a/spring-boot-admin-server-ui/src/main/frontend/views/applications/NotificationFilterSettings.spec.ts b/spring-boot-admin-server-ui/src/main/frontend/views/applications/NotificationFilterSettings.spec.ts
new file mode 100644
index 00000000000..bdc57a83505
--- /dev/null
+++ b/spring-boot-admin-server-ui/src/main/frontend/views/applications/NotificationFilterSettings.spec.ts
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2014-2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { screen } from '@testing-library/vue';
+import { describe, expect, it } from 'vitest';
+
+import { render } from '@/test-utils';
+import NotificationFilterSettings from '@/views/applications/NotificationFilterSettings.vue';
+
+describe('NotificationFilterSettings', () => {
+  it('strips dangerous markup contained in the object name', async () => {
+    const maliciousName = '<img src=x onerror="window.__xss = 1">rogue-app';
+
+    render(NotificationFilterSettings, {
+      props: {
+        object: { name: maliciousName },
+        notificationFilters: [],
+      },
+    });
+
+    // The application name still shows up as text ...
+    expect(await screen.findByText(/rogue-app/)).toBeInTheDocument();
+
+    // ... but the <img onerror=...> must have been stripped by sanitizeHtml,
+    // it must never be parsed into a real element / fire its handler.
+    expect(document.querySelectorAll('img').length).toBe(0);
+    expect((window as any).__xss).toBeUndefined();
+  });
+
+  it('renders safe HTML markup contained in the object id', async () => {
+    const nameWithMarkup = '<b>bold-instance</b>';
+
+    render(NotificationFilterSettings, {
+      props: {
+        object: { id: nameWithMarkup },
+        notificationFilters: [
+          {
+            affects: () => true,
+            expiry: null,
+          },
+        ],
+      },
+    });
+
+    // sanitize-html allows harmless formatting tags like <b> by default,
+    // so they render as real elements ...
+    const bold = await screen.findByText('bold-instance');
+    expect(bold.tagName).toBe('B');
+  });
+
+  it('strips script tags contained in the object id', async () => {
+    const maliciousId = '<script>window.__xss = 1</script>evil-instance';
+
+    render(NotificationFilterSettings, {
+      props: {
+        object: { id: maliciousId },
+        notificationFilters: [
+          {
+            affects: () => true,
+            expiry: null,
+          },
+        ],
+      },
+    });
+
+    expect(await screen.findByText(/evil-instance/)).toBeInTheDocument();
+    expect(document.querySelectorAll('script').length).toBe(0);
+    expect((window as any).__xss).toBeUndefined();
+  });
+});
diff --git a/spring-boot-admin-server-ui/src/main/frontend/views/applications/NotificationFilterSettings.vue b/spring-boot-admin-server-ui/src/main/frontend/views/applications/NotificationFilterSettings.vue
index 0f7af2f719f..1c2c5b56135 100644
--- a/spring-boot-admin-server-ui/src/main/frontend/views/applications/NotificationFilterSettings.vue
+++ b/spring-boot-admin-server-ui/src/main/frontend/views/applications/NotificationFilterSettings.vue
@@ -21,9 +21,11 @@
         <p class="control has-inline-text">
           <span
             v-html="
-              t('applications.suppress_notifications_on', {
-                name: object.id || object.name,
-              })
+              sanitizeHtml(
+                t('applications.suppress_notifications_on', {
+                  name: object.id || object.name,
+                }),
+              )
             "
           />&nbsp;
           <sba-select
@@ -53,9 +55,11 @@
         <p class="control has-inline-text">
           <span
             v-html="
-              t('applications.notifications_suppressed_for', {
-                name: object.id || object.name,
-              })
+              sanitizeHtml(
+                t('applications.notifications_suppressed_for', {
+                  name: object.id || object.name,
+                }),
+              )
             "
           />&nbsp;
           <strong
@@ -85,6 +89,8 @@
 <script>
 import { useI18n } from 'vue-i18n';
 
+import { sanitizeHtml } from '@/utils/sanitizeHtml';
+
 export default {
   props: {
     object: {
@@ -102,6 +108,7 @@ export default {
     return {
       t: i18n.t,
       currentLocale: i18n.locale,
+      sanitizeHtml,
     };
   },
   data() {
diff --git a/spring-boot-admin-server-ui/src/main/frontend/views/instances/details/health-details.spec.ts b/spring-boot-admin-server-ui/src/main/frontend/views/instances/details/health-details.spec.ts
index eff6ae53575..02093a781e2 100644
--- a/spring-boot-admin-server-ui/src/main/frontend/views/instances/details/health-details.spec.ts
+++ b/spring-boot-admin-server-ui/src/main/frontend/views/instances/details/health-details.spec.ts
@@ -513,5 +513,36 @@ describe('HealthDetails', () => {
       const toggleButton = screen.queryByRole('button');
       expect(toggleButton).not.toBeInTheDocument();
     });
+
+    it('should not render HTML/script markup contained in a string detail value', async () => {
+      const maliciousValue =
+        '<img src="/__nonexistent__.png" onerror="window.__xss = 1">';
+
+      const healthMock = {
+        status: 'UP',
+        details: {
+          canary: maliciousValue,
+        },
+      };
+
+      render(HealthDetails, {
+        props: {
+          name: 'db',
+          health: healthMock,
+          instance: mockInstance,
+        },
+      });
+
+      const canaryDetail = await screen.findByRole('definition', {
+        name: 'canary',
+      });
+
+      // sanitize-html strips disallowed tags (e.g. <img>) entirely, so no
+      // markup and no onerror handler must reach the DOM.
+      expect(canaryDetail.innerHTML).not.toContain('<img');
+      expect(canaryDetail.innerHTML).not.toContain('onerror');
+      expect(document.querySelectorAll('img').length).toBe(0);
+      expect((window as any).__xss).toBeUndefined();
+    });
   });
 });
diff --git a/spring-boot-admin-server-ui/src/main/frontend/views/instances/details/health-details.vue b/spring-boot-admin-server-ui/src/main/frontend/views/instances/details/health-details.vue
index 5b704f15267..fc1376a9de9 100644
--- a/spring-boot-admin-server-ui/src/main/frontend/views/instances/details/health-details.vue
+++ b/spring-boot-admin-server-ui/src/main/frontend/views/instances/details/health-details.vue
@@ -99,7 +99,7 @@
             :aria-label="detail.name"
             :aria-labelledby="`health-detail-${id}__${safeDetailId(detail.name, idx)}`"
             class="wrap-break-word whitespace-pre-wrap col-span-4"
-            v-html="autolink(String(detail.value ?? ''))"
+            v-html="autolink(sanitizeHtml(String(detail.value ?? '')))"
           />
         </template>
       </dl>
@@ -124,6 +124,7 @@ import SbaFormattedObj from '@/components/sba-formatted-obj.vue';
 
 import Instance from '@/services/instance';
 import autolink from '@/utils/autolink';
+import { sanitizeHtml } from '@/utils/sanitizeHtml';
 
 const { t } = useI18n();
 const id = useId();
diff --git a/spring-boot-admin-server-ui/src/main/frontend/views/instances/env/refresh.vue b/spring-boot-admin-server-ui/src/main/frontend/views/instances/env/refresh.vue
index 5e5f82d32a1..0b8920308ec 100644
--- a/spring-boot-admin-server-ui/src/main/frontend/views/instances/env/refresh.vue
+++ b/spring-boot-admin-server-ui/src/main/frontend/views/instances/env/refresh.vue
@@ -21,8 +21,29 @@
       <span v-text="$t('instances.env.context_refreshed')" />
     </template>
     <template #body>
-      <span v-html="$t('instances.env.refreshed_configurations')" />
-      <p v-html="refreshedPropertiesHtml" />
+      <span v-text="$t('instances.env.refreshed_configurations')" />
+      <ul v-if="currentScope === 'instance'" class="properties-list">
+        <li
+          v-for="(entry, idx) in instanceChangedProperties"
+          :key="idx"
+          v-text="entry"
+        />
+      </ul>
+      <ul v-else class="properties-list">
+        <template
+          v-for="(entry, idx) in applicationChangedProperties"
+          :key="idx"
+        >
+          <li v-text="`instanceId: ${entry.instanceId}`" />
+          <ul class="properties-list">
+            <li
+              v-for="(property, pIdx) in entry.changedProperties"
+              :key="pIdx"
+              v-text="property"
+            />
+          </ul>
+        </template>
+      </ul>
     </template>
     <template #footer>
       <button class="button is-success" @click="closeModal">
@@ -61,37 +82,16 @@ export default {
     instanceCount() {
       return this.application.instances.length;
     },
-    refreshedPropertiesHtml() {
-      if (
-        this.currentScope === 'instance' &&
-        this.refreshedProperties.length > 0
-      ) {
-        return (
-          '<ul class="properties-list">' +
-          this.refreshedProperties[0].changedProperties
-            .map((entry) => '<li>' + entry + '</li>')
-            .join('') +
-          '</ul>'
-        );
-      } else {
-        return (
-          '<ul class="properties-list">' +
-          this.refreshedProperties
-            .filter((property) => property.changedProperties.length > 0)
-            .map(
-              (entry) =>
-                '<li>instanceId: ' +
-                entry.instanceId +
-                '<ul class="properties-list">' +
-                entry.changedProperties
-                  .map((property) => '<li>' + property + '</li>')
-                  .join('') +
-                '</ul>',
-            )
-            .join('') +
-          '</ul>'
-        );
+    instanceChangedProperties() {
+      if (this.refreshedProperties.length === 0) {
+        return [];
       }
+      return this.refreshedProperties[0].changedProperties;
+    },
+    applicationChangedProperties() {
+      return this.refreshedProperties.filter(
+        (property) => property.changedProperties.length > 0,
+      );
     },
   },
   methods: {
diff --git a/spring-boot-admin-server-ui/src/main/frontend/views/instances/jolokia/m-bean-operation.spec.ts b/spring-boot-admin-server-ui/src/main/frontend/views/instances/jolokia/m-bean-operation.spec.ts
index 221b93f701a..c5a0c9cac8b 100644
--- a/spring-boot-admin-server-ui/src/main/frontend/views/instances/jolokia/m-bean-operation.spec.ts
+++ b/spring-boot-admin-server-ui/src/main/frontend/views/instances/jolokia/m-bean-operation.spec.ts
@@ -58,4 +58,23 @@ describe('m-bean-operation.vue', () => {
 
     expect(screen.queryByTestId('mBeanOperationModal')).toBeNull();
   });
+
+  it('does not render HTML/script markup contained in the operation name', async () => {
+    const maliciousName = '<img src=x onerror="window.__xss = 1">()';
+
+    render(MBeanOperation, {
+      props: {
+        name: maliciousName,
+        descriptor: { args: [], ret: 'void' },
+      },
+    });
+
+    await userEvent.click(screen.getByText(maliciousName));
+
+    await screen.findAllByTestId('mBeanOperationModal');
+
+    // The malicious markup must show up as plain text, never be parsed as HTML.
+    expect(document.querySelectorAll('img').length).toBe(0);
+    expect((window as any).__xss).toBeUndefined();
+  });
 });
diff --git a/spring-boot-admin-server-ui/src/main/frontend/views/instances/jolokia/m-bean-operation.vue b/spring-boot-admin-server-ui/src/main/frontend/views/instances/jolokia/m-bean-operation.vue
index 87009767d67..9e02bb93659 100644
--- a/spring-boot-admin-server-ui/src/main/frontend/views/instances/jolokia/m-bean-operation.vue
+++ b/spring-boot-admin-server-ui/src/main/frontend/views/instances/jolokia/m-bean-operation.vue
@@ -40,7 +40,11 @@
     <template #header>
       <span
         v-html="
-          $t('instances.jolokia.execute_modal_header', { name: shortenedName })
+          sanitizeHtml(
+            $t('instances.jolokia.execute_modal_header', {
+              name: shortenedName,
+            }),
+          )
         "
       />
     </template>
@@ -54,6 +58,7 @@
 </template>
 
 <script>
+import { sanitizeHtml } from '@/utils/sanitizeHtml';
 import { truncateJavaType } from '@/views/instances/jolokia/utils';
 
 export default {
@@ -86,6 +91,7 @@ export default {
     },
   },
   methods: {
+    sanitizeHtml,
     closeModal() {
       this.isModalOpen = false;
     },